This document defines the security boundaries, data sensitivity classifications, trust rules, credential isolation, and approval policies enforced by ARES.

All records ingested into the persistent task and session database are assigned a sensitivity classification level:

• Data classified as secret is handled strictly by the local host platform controller and is never transmitted in prompt text or briefings.
• Data classified as private is routed exclusively to approved local on-device models such as Jaeger AI or Ollama.
• Data classified as sensitive requires explicit user authorization prior to transmission to any runtime.

When Local-Only Mode is enabled:

• All data classified above public is automatically elevated to private.
• Communication with remote cloud API runtimes is strictly blocked.
• All context processing is handled on-device by local subprocess agents.

The platform controller requires explicit interactive user confirmation before taking high-risk actions:

1. Executing shell commands or terminal operations.
2. Writing to external calendars or stateful third-party APIs.
3. Modifying or deleting system files.
4. Transmitting sensitive level data across a network boundary.

• API keys, OAuth tokens, and system secrets are managed by the platform secret vault (services/controller/api/secrets.py).
• Secrets are passed to subprocess agents via environment variable injection or secure headers. They are never rendered into conversational text context or model prompts.

AI runtimes are treated as untrusted execution environments:

• Output from an AI runtime is parsed, sanitized, and verified by the platform controller before being presented to the user or committed to persistent memory.
• Dynamic tool call execution requests must pass schema validation and authorization policy checks prior to invocation.

ARES writes only to ARES-owned state. Worker databases, transcripts, and configuration stores belong to their respective applications. When ARES reads external history, database connections use read-only mode and must not create WAL, journal, lock, or migration files in the worker's home directory.

ARES continues a worker conversation through the worker adapter's resume or append contract. It never simulates continuation by modifying a worker store. Destructive actions against imported history are refused unless an explicit, authorized ownership contract exists.

Development and test runs use isolated ARES, Hermes, and provider state unless the operator explicitly selects production state. Diagnostic output must not print API keys, OAuth tokens, cookies, password hashes, complete environment files, or authentication stores.