Security and protection
Owner access, profile isolation, machine privileges, and approval behavior.
Jian is designed for one trusted owner per installation. Profiles isolate agent state within that installation; they are not unrelated tenants in a hosted SaaS. Provider connections, integrations, and machines are gateway-wide resources.
Credential types
| Credential | Intended authority |
|---|---|
Host token (JIAN_API_TOKEN) | Owner administration of the gateway |
| Panel session | Authenticated browser access; HttpOnly, SameSite cookie with the panel request header |
| Channel token | Access to that channel's messaging surface |
| Machine worker token | Authentication for a specific connected worker |
| Provider/integration secret | Authorization at the external service |
These are not interchangeable. Do not give an API chat client the owner token when it only needs a channel token.
Provider, integration, and channel secrets are stored in an encrypted vault. The master keyring must be protected outside the database backup. Encryption at rest does not defend against an attacker who controls the running gateway and its keys.
Conversation protection
| Mode | Behavior |
|---|---|
Ask first (ask) | Pauses guarded actions for an authorized person's decision |
Auto (auto) | Allows actions unless a guardrail classifies them as catastrophic, such as irreversible destruction or credential leakage |
Full access (full) | Lets actions run without that approval gate |
Reading, searching, and answering normally do not require approval. Machine commands, file changes, service writes, and messages to others are action categories. Some tools combine several kinds of behavior; inspect the proposed action rather than assuming its name makes it harmless.
Auto is a judgment-based guard, not a mathematical proof of safety. Full access removes approval friction but does not grant missing OS permissions or service credentials.
Who can approve
The owner can approve from the panel. A messaging contact can approve only when granted that right. In an Ask first channel conversation with no eligible approver, the action is refused with an explanation rather than silently proceeding.
Internal workers inherit their originating conversation's protection. When they cannot request approval, they report the proposed action to the parent. Delegation does not grant extra authority.
MCP tools declared read-only by their server are treated as reads; other MCP tools are service actions. This classification trusts the server's annotations, so choose connected servers accordingly.
Filesystem boundaries
Gateway shell/file tools operate in the profile workspace, with OS enforcement where supported and a stripped-down environment. This prevents ordinary tool access from simply inheriting the gateway's secret environment or another profile's files.
A connected machine has a different boundary: the worker runs as its OS account, with that account's local privileges. All agents on the gateway can use connected machines. Connect an account and computer appropriate to the access you intend to grant.
Data leaving the installation
Self-hosting the gateway does not make configured cloud services offline. Model providers receive request content. MCP servers receive tool inputs. Computer screenshots may become model input. Jev receives bounded material for enabled decisions. Messaging channels deliver content through their platform.
Use a compatible model service you control when you need that part of processing on your own infrastructure, and evaluate the remaining integrations separately.
Network and instructions
Expose the web panel through HTTPS for internet access and keep PostgreSQL private. Configure proxy trust and private-origin allowances deliberately; see configuration.
A document, web page, tool result, imported skill, or another agent's message can contain misleading instructions. Textual boundaries help guide a model but do not replace real authorization, OS permissions, or review of consequential actions.
Implementation reference
Protection enforcement, panel sessions, and runtime authentication.