01
Modes
Plan and Review stay read-only.
The protection is enforced before the side effect path, rather than relying on the Agent to remember a conversational instruction.
Security by architecture
Capability is explicit. Boundaries are concrete.
Artemis does not pretend that local Agent work is risk-free. It makes the execution mode, trust source, and sandbox boundary part of the product architecture.
Read-only means execution never receives the call.
In Plan and Review, writes are denied before an executor or filesystem operation runs. Those modes do not receive Shell, MCP tools, or executable extensions.
02
Policy and approval
Execute makes power visible and policy-aware.
Shell is available only in Execute and runs with the current desktop user’s filesystem and network permissions. Tool actions follow the configured policy and approval path; Artemis does not claim that every execution requires manual approval.
03
AppContainer and Seatbelt
Local MCP servers start inside an OS sandbox.
Enabled local stdio servers use AppContainer on Windows or Seatbelt on macOS by default. File access is limited to the task workspace and private runtime directory; network and environment access are configured per server. Trusted servers can explicitly opt into unsandboxed compatibility mode; tool approval still applies.
04
Executable extensions
Trust is tied to the project and content hash.
Extensions remain disabled until explicitly trusted and use the platform-native sandbox by default. Full local access is an extension-only compatibility choice; it does not alter Shell, Terminal, or MCP permissions.
05
Credentials
Secrets use the operating system’s protected storage.
Artemis stores supported credentials through Electron safeStorage. Configuration import is category-selective and must not silently copy credentials.
06
Project-first memory
Memory is bounded and never outranks the request.
Experiential memory is validated, scoped to the project first, and lower priority than the current request and system policy. Secrets and transient task state do not belong there.
07
Browser boundary
The web can run without inheriting desktop power.
The Browser supports HTTP, HTTPS, JavaScript, cookies, and web storage, but does not expose Node integration, preload APIs, or local-file access.
08
IM
Remote work has its own permissions.
IM access is disabled by default. Paired accounts receive explicit project grants, and remote tasks use scoped tools with a native sandbox. They do not inherit desktop Shell access.
Understand your data choices.
Read how Artemis handles your data, connected accounts, and model services before using it for sensitive work.