Skip to main content

​
Trust Model

Risoluto is designed for local, operator-controlled, high-trust environments. It runs on your machine or a VDS you control — there is no cloud service, no SaaS, and no shared infrastructure.

​
Trust Layers

Three components form a chain of trust. Each layer controls a different decision boundary.
LayerComponentControls
1RisolutoWhen to launch work, which workspace the worker can access, resource limits, network policy
2CodexHow to execute each turn — tool approvals, sandbox enforcement, MCP server access
3Provider / ProxyWhere the model call is routed — backing account, rate limits, content policy

​
Sandbox Policies

The thread_sandbox setting controls what the Codex agent is allowed to do inside its container.
PolicyDescriptionRisk level
workspace-readRead-only access to the workspace. No file writes, no shell commands.Low
workspace-write (default)Read/write access scoped to the workspace directory. Shell commands allowed within the workspace.Medium
danger-full-accessUnrestricted filesystem and network access inside the container.High
danger-full-access gives the agent full control inside the container. Only use it for trusted, well-understood workloads — never in shared or production environments.

​
Default Trust Posture

SettingDefault value
codex.approval_policy"never" (auto-approve all tool calls)
codex.thread_sandbox"workspace-write"
Recommended posture by environment:
  • Local development — workspace-write with approval_policy: "never" (the default). Fast iteration, scoped writes.
  • Shared staging — workspace-write with approval_policy: "unless-allow-listed". Require explicit approval for unknown tools.
  • Untrusted workloads — workspace-read with a strict egress allowlist. Maximum containment.

​
Docker Sandbox Boundary

Agents run inside Docker containers with configurable security hardening.
PropertyHow it works
Path identityWorkspace paths bind-mounted at the same absolute path
Auth preservationCredentials injected into per-attempt runtime home
Host permissionsContainer runs as --user $(id -u):$(id -g) — no ownership drift
NetworkDefault bridge (full internet) or restricted custom network

​
Security Hardening

OptionConfig keyDefault
No new privilegescodex.sandbox.security.noNewPrivilegestrue
Drop capabilitiescodex.sandbox.security.dropCapabilitiestrue
gVisor runtimecodex.sandbox.security.gvisorfalse
Seccomp profilecodex.sandbox.security.seccompProfile"" (Docker default)

​
Egress Allowlist

Restrict outbound network access from agent containers: 
codex:
  sandbox:
    egress_allowlist:
      - api.openai.com
      - api.linear.app
      - "*.github.com"
Enabling the egress allowlist adds CAP_NET_ADMIN back despite --cap-drop=ALL. This partially weakens the default capability posture but is required for iptables-based filtering inside the container.

​
Credentials

CredentialSourcePurpose
Linear API keytracker.api_key (typically $LINEAR_API_KEY)Poll and transition issues
Codex authAPI key or auth.json from codex.auth.source_homeModel API calls
GitHub PATOptional, via setup wizard or $GITHUB_TOKENPR creation
All credentials are stored in an AES-256-GCM encrypted store (secrets.enc) protected by the master key generated during setup. The master key never leaves your machine.

​
Provider Boundary

Risoluto supports three auth modes for connecting to the model provider: 
codex:
  auth:
    mode: api_key
Standard OpenAI API key (sk-...). Risoluto validates and encrypts it during setup.
codex:
  auth:
    mode: api_key
  provider:
    base_url: https://my-proxy.internal/v1
Any OpenAI-compatible endpoint. Useful for cost tracking proxies, self-hosted models, or enterprise gateways.
codex:
  auth:
    mode: openai_login
Authenticates via PKCE in your browser. Uses your ChatGPT/Codex subscription directly.
When running in Docker, containers cannot reach 127.0.0.1 on the host. Risoluto transparently rewrites host-bound URLs to host.docker.internal.

​
Network Security

See the Network Security guide for bind address, write tokens, and rate limiting configuration.

​
What’s Next

How It Works

Full architecture walkthrough — polling, workspaces, sandboxes, delivery.

Network Security

Bind address, write tokens, rate limiting, and TLS.

Custom Sandbox

Build a custom sandbox image with your own dependencies.

Configuration

Customize sandbox policies, auth modes, and security hardening.
Last modified on March 31, 2026