patchwork-os

Least-privilege permissions

• Scope credentials by service and action: Issue GitHub tokens with repo:read-only or limited scopes; Slack bots restricted to specific channels; Gmail read-only where write access isn't needed. Map each agent to minimum required permissions and rotate quarterly.
• Revoke autonomy thresholds explicitly: Define hard limits (e.g., agents auto-approve <$5 spend or <3-person Slack messages only). Require human approval above thresholds; log every autonomy boundary crossed.
• Isolate MCP tool access: Whitelist only necessary IDE tools from the 180 available; disable shell execution or file system access unless the agent's job requires it. Review Claude Code bridge integrations monthly.
• Separate credential storage by trust tier: Store high-risk tokens (GitHub admin, Gmail) in encrypted vault separate from low-risk API keys; never co-locate all credentials in a single config file.

Network isolation

• Run patchwork-os in a dedicated container or VM: Isolate the local runtime from your main workstation; use network segmentation (e.g., separate VLAN) so a compromised agent cannot pivot to other machines on your home/office network.
• Disable outbound access except to whitelisted service APIs: Block agents from reaching external domains; proxy all outbound traffic through a firewall rule that allows only GitHub, Slack, Gmail, and explicitly approved services.
• Encrypt credential transmission: Enforce TLS 1.3 for all agent-to-service communication; never log unencrypted tokens in transit or at rest.

Monitoring

• Log every agent decision and approval state: Capture who (which agent), what (action), when, and approval status in append-only logs; alert immediately on any autonomy-granted action that deviates from policy.
• Audit credential access patterns: Track which agent accessed which token, when, and for which API call; flag unusual patterns (e.g., agent accessing email token when it should only touch GitHub).
• Monitor MCP tool invocations: Log all IDE tool calls from Claude Code bridge; alert if tools outside the whitelist are invoked or if shell/file commands execute unexpectedly.
• Real-time anomaly detection: Set alerts for failed authentication attempts, token refresh anomalies, or agents acting on suspicious input (e.g., PR titles with injection patterns).

Red flags to watch for

• Autonomy drift without explanation: Agent escalates privilege level or auto-approves risky actions without new policy change; review the track-record scoring logic and revert autonomy if unclear.
• Prompt injection indicators in logs: Spot GitHub PR titles, Slack messages, or email subjects containing code, shell syntax, or policy-override language; quarantine that input and manually review agent response.
• Credential usage spikes or lateral movement: Sudden access to services the agent doesn't normally touch; token used for multiple unrelated APIs in one session; possible compromise or misconfigured policy.
• Laptop compromise signals: Failed OS-level security checks, unexpected processes accessing patchwork