# Remoko Security Model

> Remoko is built on the assumption that AI agents are highly capable but fundamentally untrusted actors. The system enforces hard constraints so the human owner remains in control.

Canonical HTML page: https://remoko.app/docs

## Constraints

- **No agent overrides.** Agent credentials are cryptographically scoped. They can create and update requests, but they can never answer on the owner's behalf. Submitting an answer requires the authenticated context of the owner's iOS device.
- **Strict versioning.** Every owner response includes the exact version of the request they saw. If the agent modifies the request while the owner is answering, the response is rejected — preventing bait-and-switch races.
- **Risk segregation.** Approvals carry a risk level (low / medium / high / critical). High-risk and critical approvals never expose lock-screen quick actions — they must be opened and answered inside the app. Bulk approval is hard-coded to low-risk items only.
- **Append-only audit.** The lifecycle of every request is logged in an append-only audit trail visible in the app.
- **Token rotation.** If an agent goes rogue or a token leaks, the owner can instantly revoke and rotate the endpoint token from the Connect tab.

## Data policy

- Sign-in is passwordless: phone number + SMS verification. No passwords; no email address required.
- Remoko is a secure secondary mirror of decision state, not the source of truth. Agents must re-validate against their primary system before executing.

## Sitemap

- [Overview & quickstart](https://remoko.app/docs/index.md)
- [MCP tools reference](https://remoko.app/docs/mcp-tools.md)
- [FAQ](https://remoko.app/docs/faq.md)
- [Privacy policy](https://remoko.app/privacy)