Skip to main content
Studio’s support agents connect intake, investigation, approved action, verification, and customer response. They use scoped service credentials and supported cloud tools; people also have a desktop workspace for hands-on access. This section explains the controls across those execution paths and the limits that matter when agents work on customer or internal systems. We wrote it for the person who has to sign off on Studio for their environment. It’s not a marketing page. It cites the actual controls we’ve built, names the cryptographic primitives, and is honest about the things that aren’t done yet. If you find a gap, tell us — that’s how this gets stronger.

​
The principles

Six commitments shape every safety decision Studio makes:

Plaintext minimization

Supported secret fields use envelope encryption and Key Chain resolution. Plaintext still exists when a value is displayed or used, and local recordings, exports, or prompts can create additional copies that need their own controls.

Approval before consequence

Cloud-worker connector writes require independent approval of the exact request. Interactive desktop tools have their own approval model; desktop Autopilot removes its per-call prompts and does not change worker approval requirements.

Tenant isolation by cryptography

Organization authorization is reinforced by per-organization encryption for supported sensitive fields. Metadata and unencrypted fields still depend on identity, resolver, and storage controls.

Explicit provider and processing scope

Claude models use AWS Bedrock; OpenAI models use Studio’s authenticated proxy. Org Brain answers have a separate disclosed processing policy. The Bedrock region selector does not control OpenAI processing.

Auditability over autonomy

Tool activity, conversation history, usage, and supported audit events make operational work inspectable. Coverage differs by surface, so target-system logs and endpoint evidence remain important.

Honest limits

Some things are not built yet. Some things never will be (because they conflict with operational reality). We document both. Buying decisions made on incomplete information cost more than the truth.

​
What’s on this tab

Threat model

What we’re defending against, what we’re not, and the assumptions our controls rely on.

Identity and access

Clerk for the user, Cognito for the AWS calls, organization isolation enforced top to bottom.

Vault and keys

Per-org KMS keys in a FIPS-validated HSM, AES-256-GCM envelope encryption, automatic 30-day DEK rotation, cryptographic shredding on org deletion.

Human in the loop

The trust-level model, tool classification, the approval gate, and how the steering controls let you stop or redirect a running agent in real time.

AI provider and data flow

Bedrock and OpenAI routes, Org Brain retrieval and synthesis, context safeguards, and the boundary between local execution and cloud processing.

Agent and local runtime

Electron + Go sidecar architecture, what stays on your device, the local embeddings model, and how the desktop process talks to the backend.

Audit and telemetry

Desktop and worker audit chains, exports, redaction, and what Sentry and Amplitude receive.

Connectors and MCP safety

How third-party API credentials are stored, how MCP tool catalogs are gated, and what happens if a remote MCP server tries to misbehave.

Supply chain and updates

Code signing, notarization, update signature verification, the build pipeline, and the path from source to your machine.

Known limits and roadmap

The honest list of what isn’t done yet and what we’re working on. Read this before committing.

​
A one-paragraph version

Studio uses Clerk for user identity, scoped authorization for cloud requests, and per-organization encryption for supported sensitive fields. Copilot and cloud workers operate under tool policy and approval controls. Claude inference uses AWS Bedrock; OpenAI inference uses Studio’s authenticated service. Org Brain adds permission-scoped cloud retrieval and separately consented answer synthesis. Desktop and worker audit streams make supported actions inspectable. Review the data flow and known limits against your organization’s requirements.

​
Apply controls by surface

The normal chat approval model is only one boundary. Browser autopilot, Computer Use, generated apps, Studio Remote, shared sessions, cloud workers, and managed Remote Desktop each add a distinct execution or delegation path. Org Brain adds a separate information-sharing boundary: a retrieved passage must be authorized and remains untrusted input. Review the page for each surface before enabling it. For an operator-focused control summary, see Security and privacy.

​
How to read this section

If you’re a CISO doing initial diligence: read threat model, vault and keys, known limits, in that order. If you’re a security engineer doing the deep review: read every page. The vault and HITL pages have the most engineering detail; the supply chain page has the most surprises. If you’re an MSP or ISP team lead deciding whether your operators can use Studio: read overview, human in the loop, and audit and telemetry.