# Lending models between machines

A borrowed model = an API-call replacement over your own tailnet. The lender's models appear in your picker grouped under that computer's name and work everywhere a local model does (chat, kapsules, delegation). Setup: one kcat_ connection code. How-to: https://chynj.ca/kaptain/docs/how-to/lend-models/

## What crosses the wire
- Compute crosses. Prompts cross (the lender's model must read the conversation — weigh this if the machines are trusted differently).
- Authority NEVER crosses: requests strip session keys, approval modes, trusted scopes.

## The three tiers of a kcat_ code
observe (see model list) < infer (run inference) < admin (infer + manage the lender's own grants). Deliberately NO tool tier. kcat_ lends a model; chynj_ signs in a person.

## The CLI-assistant exception
claude-cli / codex-cli are agents with their own tool loops: lend one and its WORK runs on the lending machine, directed by the token holder. Kaptain tags them "runs work here" and warns at grant time.

## Where tools run for plain models
The tool loop belongs to the machine that owns the conversation: a borrowed model can ASK for a file edit; it executes on YOUR machine, under YOUR approval gate.