Security & permissions

Risk levels

• 0 · Look — searching memory, reading a page, explaining a screenshot. Always allowed.
• 1 · Organise — notes, tasks, reminders, memory edits. Reversible and internal. Blocked while Stop is on.
• 2 · Reach out — anything that leaves BASI, like sending a Telegram message. Shows an Approve card every time unless you grant that one capability in Settings → Permissions (which needs your password).
• 3 · Commit — deleting projects or all data. Always needs approval and your password from the last five minutes. Can't be pre-approved.

Approvals

An approval is tied to a fingerprint (SHA-256) of the exact action. If the action changes after you approve, the approval is void. Approvals expire after 15 minutes and can be used once.

Stop all tasks

One button in Activity cancels queued jobs, signals running missions to stop at their next checkpoint, withdraws pending approvals and pauses automations. It reports what stopped and what couldn't stop instantly.

Untrusted content

Web pages, documents, screenshots and search results are treated as data. Instructions inside them are ignored and can never grant permissions.

Accounts

• Passwords are hashed with bcrypt. Session tokens are random and stored only as HMACs.
• First-time setup needs a one-time token from the server's .env, so nobody else can claim your instance.
• Sign-in attempts are rate-limited. You can see and revoke signed-in devices.
• Every sensitive event is written to an audit log without secrets.

Spending

Daily, monthly and per-mission limits in naira, plus a zero-spend switch. Missions can't start other missions, and each turn has a tool-call cap.