Guard Mode · everyday work

Full speed. Full visibility. No ambient authority.

Guard Mode is how BitShout runs most of the time. The agent stays native — same binary, same performance, same workflow — but its authority is drawn explicitly rather than inherited from your account. Four domains, each deny-by-default, each answerable to you.

Get BitShoutCompare with Vault Mode
BitShout — AI Containment Protection on
Protected apps3All contained
Awaiting you2Approval requests
Denied today17Policy + OS
Evidence records842Local, hash-chained

Protected applications

CGChatGPTcom.openai.chatGuard Mode~/Projects/appRestricted
CLClaudecom.anthropic.claudeGuard Mode~/Projects/appRestricted
>_Codex CLIcom.openai.codexVault Mode~/Projects/appProxy only

Recent activity live

Claude requested to read ~/.ssh/id_ed25519Denied2m ago
Codex CLI requested network access to 192.168.1.40:22Denied5m ago
ChatGPT requested to write ~/Documents/notes.txtAllowed once12m ago
Claude used MCP tool github.read_repositoryBrokered18m ago
Codex CLI spawned bash → curl → api.github.comDenied21m ago
Claude requested Keychain item aws-prodDenied24m ago
Four authority domains

Separate questions, separate answers.

Most tools collapse "can this app do things" into a single switch. Authority is not one question, and an agent that legitimately needs to write to one folder has no business reading your keys because of it.

Filesystem

One granted workspace, read or write, resolved to real objects. Credential stores, browser profiles, unrelated repositories and mounted shares are denied because nothing granted them.

Read the model →

Network

Outbound destinations, LAN devices, loopback services, multicast and inbound listening are each separate authority. An allowed API endpoint is not a licence to scan your subnet.

Read the model →

Execution

Shells, interpreters, package managers, automation tools and helper binaries are execution targets with identities, and the containment session follows every one of them.

Read the model →

Capabilities

MCP tools and credential-backed operations go through the broker. The agent receives results, not the secret behind them.

Read the model →
Filesystem

Granted, resolved, and checked again.

~/Projects/appgranted workspace · read + write
src/
node_modules/
keys → ~/.sshsymlink
~/Documentsnot granted
~/.sshcredential store
~/.awscredential store
~/Library/Application Support/…browser profiles
/Volumes/NASnetwork mount

Resolution, not comparison

  1. requested~/Projects/app/keys/id_ed25519
  2. expanded/Users/you/Projects/app/keys/id_ed25519
  3. symlinks resolved/Users/you/.ssh/id_ed25519
  4. device / inodedev(1,17) : 8814402
  5. verdictoutside grant → deny

Prefix matching on the requested string would have allowed this. BitShout matches on the resolved object, so the link leads nowhere.

Network

Your LAN is not the internet, and neither is your loopback.

Default ruleDeny all connections unless explicitly allowed
CLapi.anthropic.com:443Claude · internetexplicit grant · 30 minAllow
CHapi.openai.com:443ChatGPT · internetexplicit grant · sessionAllow
CO192.168.1.40:22Codex CLI · local networkno matching allow ruleDeny
CO127.0.0.1:5432Codex CLI · loopbacklocal service not grantedDeny
CL224.0.0.251:5353Claude · multicastmDNS discovery not grantedDeny
CLlocalhostClaude · no resolved address · unknownhostname evidence only → unknown → denyDeny
Execution

Descendants are not a loophole.

claudesigned · Anthropicbashchild · /bin/bashpython3grandchild · py3curlgreat-grandchildSESSION 7C4AContained subjectStill containedconnect 192.168.1.40:22 — deniedNo matching allow rule for the inherited session→ deny. Lineage is part of the boundary, not a way around it.
Living with it

Security you do not have to babysit.

Native speed

No virtual machine, no translation layer, no filesystem shim in the hot path. The agent runs on your Mac the way it always did.

Per-app policy

Each protected application gets its own workspace, its own network rules and its own capability set. One agent’s grant is not another agent’s grant.

Panic Lock

One control that stops new authority immediately and suspends existing grants. Recovery is an explicit revalidation, not a shrug.

Nothing to remember

Grants expire. A “for this session” allowance dies with the session, and a duration grant dies on the clock — without you having to go back and clean up.

!

Guard Mode is a policy boundary, not a virtual machine. It contains authority; it does not pretend the agent is running on a different computer. When a workload deserves a different computer, that is what Vault Mode is for.