Who this document is for

Two readers. An evaluator deciding whether to let AI coding agents run unattended on machines they own: read In one paragraph, What the risk actually is, Design principles and Documented limits. An administrator or security engineer who needs to know which mechanisms are in play, what the defaults are and what to configure: read the controls, then the Administrator's runbook and the Worked examples.

Documented limits lists what this system does not protect against. It is not an afterthought. A security document without one is marketing.

There is no source code here. There are named mechanisms, algorithms, defaults and configuration keys, because those are what you need to evaluate the claims — and the worked examples show the ceremonies and enrollment flows with the real commands, so you can see how the controls are operated rather than take our word that they exist.