An explicit capability model
Every tool call is gated by a scope the agent has to actually hold — not a policy document, a check that runs before the action happens. The agent can't reach further than you've granted, and it can't grant itself more.
Security you can verify, not just trust.
Most AI agents ask you to trust a vendor's privacy policy. Aivyx PA gives you a capability model and an audit chain you can check yourself — trust that's earned by what you can verify, not what you're promised.
An HMAC-chained audit log
Every action lands on an append-only, cryptographically chained log. You can verify it offline, without trusting a server — tampering with one entry breaks the chain for everything after it.
Encrypted at rest
Local storage is encrypted with a passphrase only you hold. Not "encrypted in our cloud" — encrypted on your disk, under your key.
Local-first, by construction
Your model runs on your own machine, or your API key talks directly to the LLM provider you chose. There's no Aivyx PA server sitting in the request path to leak, subpoena, or go down.
Commands run in a sandbox
On Linux, shell and git commands run under Landlock and seccomp: they stay inside the folders you've opened to the agent, can't reach local daemons, and are stopped when the call that started them ends. Git hooks get a clean environment, never the agent's secrets.
Changes you can roll back
Before a file write, delete, shell command or commit, the agent snapshots your files to a hidden git ref — so a change can be undone without touching your own branch.
A check on what it reads
Web pages, files and other untrusted output are fenced off from instructions and scanned for prompt injection. A hit stops for your review instead of being acted on.
"The agent can't reach further than you allow — and you can check that it didn't."