Goal
Define security boundaries for external AI providers and local models.
Scope
- Add user consent gate before external data egress
- Define allowlist/scoping for context payloads
- Add budget/rate limits for agent-triggered actions
Acceptance Criteria
- External provider calls require explicit opt-in
- Limits are configurable and enforced
- Security behavior documented in
SECURITY.md
Goal
Define security boundaries for external AI providers and local models.
Scope
Acceptance Criteria
SECURITY.md