VectorBrainDownload What an agent may do is decided by where its information came from and by rules you set, checked on every call, whatever the model was told. Here is what that looks like when it bites.
VectorBrain’s real interface, running on example data. The ferry operator and its site are invented.
Nine commands reach outside the app. Once a run uses one, it can still read, answer and write what it found as a new document, but changing anything that already exists, deleting and running a program are refused until your next message.
It is decided by where the text came from, not by what it says, so no wording on a page can talk its way past it.
get the fares from the operator’s page and put them in the post
A waiting action is stored as the input it will run, and Allow replays that input word for word. The model is not asked again.
A run started by a stranger’s email can propose a file change but never make one. The card waits for you, and nothing lifts that: not god mode, not a remembered yes.
a booking change arrived by email
Everything you and the agents do goes through one command bus and lands in one journal, refusals included. Undo is an ordinary command off a row, so it survives a restart and passes the same checks.
Only what can be put back: a push, a sent message or a submitted form has left the machine.
Running a program asks at Always ask and Normal; only god mode lifts that. Each command gets a write-restricted token inside a job object: it can write to the project and toolchain caches, and it dies when the app closes.
It does not confine reads or the network, and the settings screen says so in those words.
An MCP server you connect can stop mid-call to ask a question. The form comes to you, and your answer goes to that server only: not to the model, and not into the journal.
A tool that acts asks the first time, and any standing allow is a switch you can see and take back.
git.commit and git.push stop for you at every trust level, god mode included. Work is reversible; a commit is a claim about what happened, and that is yours to make.
vb-bus/src/policy.rs · RECORDSThe commit card, when it codesEvery file command resolves its path through one function, paths::locate, which resolves .. and symlinks before it checks, and refuses anything outside a project you added.
vb-cmd-fs/src/paths.rsfs.edit replaces an exact passage in a file the run has read, and only if it appears exactly once. The read is checked in the journal, so a summarised conversation cannot forget it.
vb-cmd-fs/src/edit.rsThe Canvas renders in a frame with an empty sandbox: no scripts, no forms, no navigation. The opt-in Live preview allows scripts, and its policy refuses every fetch, including one aimed at the app.
ui/src/Canvas.tsxThe OpenRouter key and connection tokens live in the operating system’s credential store. A command carrying a credential can never be approved into running, because an approval stores its input as it will run.
vb-llm · keyring; vb-bus/src/bus.rsThe key, on ModelsThe window loads nothing from the internet, and nothing goes to us, because there is nowhere for it to go. What does leave: the prompt and context you send to the model you picked, through OpenRouter; a page you or the agent open; and calls to a server you connected. This website is separate and says what it measures on Privacy.
vb-cmd-core · exactly_these_commands_reach_outside_the_trust_boundaryui/src/levels.tsvb-bus/src/policy.rs · RECORDS, ACTS_OUTWARDvb-bus/src/policy.rs · REVIEWED_WHEN_TRIGGERED, CREATES_WHEN_TAINTEDvb-sandbox; vb-agent/src/role.rs · PERSON_CEILINGvb-cmd-mcp/src/elicit.rsvb-cmd-core · app.backup; vb-db/src/lib.rscrates/vb-app/tauri.conf.jsonCargo.toml, ui/package.jsonIt can say anything, but it cannot authorise anything. Reading a page marks the run external, and an external run is refused every change to what already exists, every deletion and every command until the person’s next message. It may still make something new, a Canvas document or a .md, .txt or .csv file under the project’s web/ folder, and both stay marked as from the web. The limit is on actions: a model can still be misled about what it says, so read a summary of an untrusted page as a summary of an untrusted page.
No. On Windows, confining reads needs commands to run as a separate Windows account, which this build does not do. A command can read files outside the project, including keys and browser profiles, and can reach the network. The app shows these limits in the sandbox’s own words under Settings, Trust. The sandbox, when it codes
Only the asking for ordinary work. The sandbox, commit and push asking, the taint rule, the spending ceiling, person-only commands and the browser pane’s own permission all stay. In the app’s words, god mode means do not interrupt me while you work; it never means decide for me what counts as done.
No. Approving, setting a trust level and changing the approval policy are person-only commands. A run that asks for one is refused before anything happens.
Whatever its tools do, behind the same gate: a tool that acts asks the first time, and standing allows are switches in Settings, Connections. What it returns is read as data. It may ask you a question mid-call, and your answer goes only to that server. It may not ask the app for a model completion; that request is refused. The full command list
No. The app has no analytics and no crash reporting, because there is no VectorBrain server to send them to. The window loads no fonts or scripts from the internet. The marketing website is a separate thing, and its analytics are described on the Privacy page. Privacy
Settings, You, Your data saves a whole copy of the database into ~/VectorBrain/backups. Restoring replaces the data with a backup and restarts the app, and first keeps what it replaces as a backup of its own. Before each database update the app also keeps a copy, the last five.
No. The build has not been measured against a conformance level, so this site states none.
Every rule on this page is enforced in the command bus, checked on every call, and visible in the journal.