Security and privacy

Studio combines local device access, organization-synchronized context, cloud AI, external integrations, and optional remote control. Security depends on keeping each action inside the correct organization, channel, credential, tool, and human-approval boundary.

​

Security model

• The desktop and local helper reach hosts and the workstation’s network from the machine running Studio.
• Altostrat organizations isolate administration, shared context, policy, and synchronized resources.
• Personal credentials and explicitly managed shared credentials have different scopes.
• Copilot tool availability is narrowed by organization, member, channel, and worker policy.
• State-changing, destructive, and unknown actions pause for review unless a high-trust setting bypasses it.
• Browser, Computer Use, generated apps, Studio Remote, and managed Remote Desktop add separate control surfaces that must be enabled and reviewed deliberately.
• Org Brain retrieves only within the caller’s permitted organization, channel, and source scope; enabling it does not make private material organization-wide.

​

Trust boundaries

​

Credentials and Key Chain

Use Key Chain references instead of placing secrets in prompts, procedures, connector definitions, memories, artifacts, or channel context. Studio supports:

• Personal credentials — private to the member and appropriate for user-attributed host or integration access.
• Shared credentials — an explicitly provisioned organization/service identity for allowed members and tools.

Sharing a host, connector, or MCP definition does not automatically share a personal credential. An admin can see a member’s credential readiness marker without seeing the private value. Shared credentials require an owner, external rotation process, and least privilege. Removing a member from Studio does not rotate a shared password, token, or key in the external system.

​

Keep secrets out of AI context

Studio resolves supported credential references at execution so Copilot does not need the raw value in its normal tool-planning context. This protection is strongest when the value stays in Key Chain. Do not store credentials in:

• Organization, member, or channel context.
• Operational or organization memory.
• Generated app source or app state.
• Dashboard variables.
• Procedure Markdown or default arguments.
• Artifacts, recordings, or transcripts.

​

Tool policy and approvals

Tool policy controls availability; approvals control a proposed call. They solve different problems. Organization policy sets a maximum. Member and channel policy can narrow it. A digital-worker stage can narrow its grants again. Runtime dispatch re-checks this effective policy, so a stale tool reference is not enough to bypass a later restriction. Review an approval as if you were performing the action manually:

1. Confirm organization and channel.
2. Confirm target and credential scope.
3. Read the exact command, request, fields, or click/type action.
4. Check side effects, rollback, and whether the call is idempotent.
5. Prefer one-time approval over Allow for session when the scope may change.

Autopilot and browser autopilot bypass approvals in their scope. They are appropriate only for bounded, pre-verified work.

​

Browser and Computer Use

Browser sessions expose a live view, proposed intent, and Take over/Release control. The browser’s autopilot toggle can auto-approve website actions for that session. Computer Use requires macOS Screen Recording to observe and Accessibility to control. Read-only observation is distinct from clicking, typing, scrolling, or opening an app. State-changing desktop actions normally require approval. Prefer a terminal, connector, MCP tool, or other structured operation over pixel control when available.

​

Sandboxed dashboard apps

Generated dashboard apps run in a sandbox. External capabilities are disabled until you grant the exact requested set. Grants are per user and bound to a capability hash; a changed capability request must be reviewed again. Limit resource origins, inspect the app’s purpose and revision, and test with capabilities disabled before granting network or mutation access.

​

Studio Remote

A paired supported mobile device can read conversation state, send messages, and respond to approval requests while the desktop remains the execution bridge. Protect the device with authentication and notification privacy. Revoke a pairing from Current connections when the phone is lost, replaced, shared, or no longer needed. Generate a new pairing code if the displayed code may have been exposed. Do not approve an action from a notification preview alone.

​

Recordings, calls, and transcripts

Terminal replays, shared-session output, call media, Audio Use transcripts, and generated summaries can contain sensitive operational data. Tell participants when recording or transcription is active and follow applicable consent and retention rules. Transcription can be wrong. Confirm names, numbers, credentials, and commands against the live source before executing or distributing them.

​

Org Brain, memory, and search

Saved memories and work-product records retain their own visibility. Org Brain indexes eligible sources in the cloud and retrieves evidence under server-side authorization. Organization admin status does not automatically grant access to another channel’s knowledge or a member’s private memory. Owner activation and answer-synthesis consent are separate controls. Read the synthesis disclosure before enabling it: the OpenAI policy permits global processing with a Bedrock fallback; a Bedrock-only policy has a different boundary. Your desktop’s Bedrock region setting does not override this policy. Disabling Org Brain stops indexing and search; it does not erase previously indexed data. Deleting a source or requesting organization offboarding is a different operation. Do not assume that deletion also removes copied answers, exports, or evidence held by another system. Review memory visibility before sharing it. Inspect citations and verify live state before acting on remembered information. Retrieved text remains untrusted evidence, even when it came from a colleague. Dream-cycle facts at or above 85% model confidence can publish automatically; lower-confidence facts wait for review. Model confidence is not proof of accuracy. Inspect published facts and retract mistakes. Consolidation proposals require a separate human decision. See Org Brain for source coverage, privacy controls, and current limitations.

​

Cloud workers and managed endpoints

Workers run in the cloud under their channel’s policy and configured service credentials. They can continue while your desktop is closed. Use explicit human gates, narrow tools, and the worker task timeline to supervise them; desktop Autopilot does not replace a worker’s approval policy. Managed Remote Desktop uses separate endpoint identity, host access, consent, and session permissions. Where the preview is enabled, connection begins with an explicit View-first preflight. A View grant is not permission to send keyboard or mouse input. Availability and platform acceptance remain gated; do not infer Control or managed AI support from the existing RDP feature.

​

Sign out and offboarding

Sign out before transferring or servicing a workstation. It ends the authenticated Studio session and removes the current user’s active access from the app; synchronized organization data remains governed by the organization. For offboarding, also transfer owned resources, remove membership, revoke Studio Remote connections, replace personal-credential dependencies, and rotate any external shared credentials the person could use.

​

Reporting a security issue

Use Altostrat’s support or security contact from your account surface. Include the Studio version, operating system, organization ID, time of the event, affected surface, and a redacted reproduction. Never attach live secrets.

​

Related