# Secured interaction

Blunt decisions over subtle ones: no internet exposure exists, one gate over every risky action, one job per credential.

## Local-first IS the security model
Runtime, conversations, keys, project: on your machine. No Kaptain cloud sees prompts. CHYNJ servers hold licensing metadata only; fingerprints travel as hashes, codes stored as hashes.

## Two network modes, no third
Local only (127.0.0.1) or Tailscale (tailnet address; every device still needs the access code). LAN/public binds are refused by the binary; unknown modes fall back to Local only. Tailscale mode refuses loopback on purpose. Device allowlist on top, with staged saves.

## Four approval modes, one gate
Ask / Read-only / Auto-approve in workspace / Full access — same gate for built-ins, MCP tools, shell. Read-only shell pipelines auto-run (no approval fatigue). Set per model and per kapsule; ships in the kapsule file.

## Scopes name targets, never tools
path (optionally rw) / one MCP server / one web host. The approval mode stays the ceiling.

## Three codes, three jobs
chynj_ signs in a PERSON · kcat_ lends COMPUTE (observe/infer/admin, never tools) · the device certificate identifies the MACHINE to the licence server. None impersonates another.

## Remote access
Sessions bind to the CURRENT access code (rotation re-pairs every device, on purpose). Access log: IP, path, status, auth per request.
Guides: /kaptain/docs/how-to/tailscale/ · /kaptain/docs/tailscale-https/