Skip to main content
Kyro is an open-source product fromTonmoy InfrastructureOwned byEshan Roy
Kyrov0.1.0
Get Kyro
Zero-Trust Architecture • Tonmoy Infrastructure

Security Boundaries & Control Architecture

Allowing an autonomous AI agent to interact with your operating system requires strict, verifiable boundaries. Kyro is an open-source product from Tonmoy Infrastructure, owned and architected by Eshan Roy. It is engineered with a zero-implicit-approval philosophy: every consequential action is evaluated and authorized at the native Rust backend execution gate.

Technical Product Documentation Notice: This documentation describes the technical controls, invariants, and enforcement policies implemented in the Kyro codebase (libkyro/src/governance/). It is not a warranty of absolute invulnerability or a substitute for an independent third-party security audit.

Five Core Security Invariants

1

Zero Implicit Approval

No tool invocation can proceed merely because a frontend flag (autoApprove: true) was supplied. Enforcement occurs exclusively inside the Rust binary.

2

Centralized Rust Evaluation

Every operation (shell tokens, file I/O, mouse/keyboard, virtual displays, MCP tools, container execution) passes through the unified AuthorizationEngine.

3

Fail-Closed Container Sandbox

When container sandboxing is required (SandboxOnly), absence or failure of Docker/Podman aborts the action rather than falling back to host execution.

4

Zero Secret Leakage

API tokens and OAuth keys are stored in the OS Keyring. Tauri IPC commands return presence metadata (is_configured: true) rather than plaintext secrets.

5

Durable CAS Approval Proofs

Human approvals are cryptographically bound to exact tool names and argument hashes, consumed via atomic SQLite Compare-and-Swap (CAS) to prevent replay attacks.

6

Autonomous Checkpoint Takeover

When screen or browser automation detects 2FA prompts, password inputs, CAPTCHAs, or banking domains, Kyro automatically halts and requires human intervention.

Enforcement Mechanisms by Subsystem

Shell Command Governance

Source: libkyro/src/governance/auth.rs

Unlike simple string execution, Kyro's authorization engine runs a lexical parser on shell commands, extracting exact argv tokens. The engine rejects:

Unchecked Metacharacters:

Pipelines (|), subshells ($(...), `...`), command chaining (;, &&), and backgrounding (&).

SafeAutoApprove Policy:

Only permits verified read-only inspection commands (git status, cargo check, npm test). Any ambiguity prompts human approval.

Fail-Closed Container Sandbox

Source: libkyro/src/sandbox/docker.rs

When configuring the agent in SandboxOnly mode:

  • Probe & Enforce: Kyro probes for active Docker or Podman daemons using CLI status checks.
  • Strict Denial: If neither container engine is responsive, the engine returns AuthDecision::Deny. It explicitly refuses to fall back to host execution unsafely.
  • Network & Resource Isolation: Spawned containers run with --network=none, memory limited to 512MB, and CPU quota capped at 1.0.

Filesystem Workspace Confinement

Source: libkyro/src/governance/auth.rs (`validate_path_confinement`)

All file operations (Read, Write, Create, Delete) are canonicalized and checked against authorized project directory roots. Path traversal sequences (../), null bytes (\0), unauthorized root paths (/etc/, C:\Windows), and symlinks that point outside the sandbox boundary are rejected unconditionally.

Credential Storage & Secret Redaction

Source: libkyro/src/storage/vault.rs

Kyro stores API keys (NVIDIA NIM, Telegram bot tokens, GitHub OAuth tokens) inside your host operating system credential manager:

  • • macOS: Apple Keychain Services
  • • Linux: FreeDesktop Secret Service via DBus
  • • Windows: Windows Credential Manager
  • • Headless Fallback: Authenticated AES-256-GCM encrypted database file with strict 0600 POSIX permissions.

When exporting workspace templates or sharing routine files (kyro.routine.v1), keys matching sensitive patterns (KEY, TOKEN, SECRET, PASS) are automatically replaced with <REDACTED_ON_EXPORT>.

Browser Automation Safety

Source: libkyro/src/browser/safety.rs

The browser automation worker restricts web sessions to an explicit origin scope. Navigations to disallowed top-level domains, private local addresses (unless permitted for development), or blocked domains (banking and financial institutions like PayPal, Chase) are halted immediately, triggering an interactive human takeover request.

Vulnerability Reporting & Responsible Disclosure

If you discover a security vulnerability or bypass in Kyro's authorization engine, please do not open a public issue. Send a private report to:

Email m.eshanized@gmail.comView SECURITY.md on GitHub