Skip to content

Security

Security

AI agents that can edit your site need hard boundaries. DuckyOS is sovereign by design.

External Agent RequestAttempting to read user database
BLOCKED
Site Assistant (Admin)Publishing new blog post
ALLOWED
Stripe PluginRequires network access to api.stripe.com
GRANTED

Controls that matter

  • Site isolation on shared cells — tenants cannot see each other’s data
  • RBAC for staff roles and agent personas
  • Master-key encryption for external API secrets
  • Sandboxed MCP tool plane with explicit plugin permission grants
  • Signed marketplace packages with install provenance

Agents never get blanket access. Every tool call is scoped to the site, the role, and the grants you approved.

Back to product