# Security defaults.

What is on without you asking, and where you set the limits yourself.

[Open the console](https://console.praecise.cloud)

[Talk to us](mailto:contact@praecise.com?subject=Praecise%20Cloud)

In short

Access is per project, settings stay outside releases, each agent runs in an isolated computer and updates are signed. This page lists the defaults and the limits you set yourself.

## On by default.

4

### Access per project

People see what they are granted.

The Cloud section of Praecise Spaces shows a person only the projects they have been granted.

### Settings outside releases

A rollback carries none.

Environment settings are kept beside the site, never inside a release.

### Isolated agents

One computer per agent.

A Silo reaches only the services its owner connects to it, and the real keys stay outside.

### Signed updates

No tampered image.

The base replaces a signed image and refuses an unsigned or tampered update.

## Limits you set.

3

Tools

### A guard decides what runs.

In a Harness app, guard.ts decides which tool calls are made, and a refusal goes back to the model as text.

Payments

### Scoped keys.

Each agent has its own Skerry key, with spend limits, approvals and revocation.

People

### Approvals.

A workflow can stop at an approve step for a person.

## Read the claims.

2

### [Security](https://praecise.cloud/security.md)

What the platform inherits from the open base.

### [Furcate on GitHub](https://github.com/furcateresearch/furcate)

Apache-2.0

The open base is public.

## Questions this answers.

4

### Can an agent reach the network?

A Silo reaches only what its owner connects to it.

### Who can see a project?

Only the people you grant access to it.

### Can an update be forged?

The base refuses unsigned or tampered updates.

### What survives a rollback?

Settings stay beside the site, not in the release.

## Next pages.

[Security](https://praecise.cloud/security.md)

[Deploying and rolling back](https://praecise.cloud/docs/deploying.md)

[Agent Stack](https://praecise.cloud/agent-stack.md)

06

## Praecise accounts are by invitation. Open the console, or talk to us.

[Open the console](https://console.praecise.cloud)

[Talk to us](mailto:contact@praecise.com?subject=Praecise%20Cloud)

New to Praecise Cloud? Accounts are set up with the Praecise team: talk to us, then sign in to the Cloud section of Praecise Spaces with an email code.

Source: https://praecise.cloud/docs/security-defaults