# Polylane security

> What agents can touch, what they can't, and every gate in between. Canonical: https://polylane.com/security

An agent with access to production should have to earn every write. Everything below is how the product actually behaves.

## Write access is earned, not assumed

- New cloud accounts connect read-only: write calls are refused until you turn read-only off, per account.
- Cloud writes pause the run and show the exact call (method, path, body, reason). Approve it, or reject it with a note the agent reads.
- With read-only off, every mutating call still passes a safety review.
- Code ships as pull requests: fixes land for your review, and Polylane merges only where you enable it, per automation.
- Deployment rollbacks are off by default, enabled per automation, receipted and rate-limited.
- Over MCP and the CLI, write tools need the agent_tools:write scope and the x-polylane-allow-writes header; every write is then screened by a safety model.

## Least privilege, end to end

- Connections ask for the minimum: AWS via a scoped CloudFormation role, Cloudflare via pre-filled token permissions, GitHub and Sentry as apps.
- Provider credentials are encrypted with authenticated encryption before storage; agents never see them.
- API keys are workspace-scoped with explicit scopes, shown once; deletion is immediate.
- OAuth 2.0 with PKCE: 1-hour access tokens, single-use refresh tokens, immediate revocation.
- Workspace roles: owner, admin, member, read-only.
- Repository sandbox secrets are encrypted before storage.

## Evidence, not vibes

- Answers link back to the query, log line, or change record behind them; tool results stay in the transcript.
- A verdict without evidence falls back to inconclusive; an investigation that couldn't reach data never confirms.
- Investigations, automations, and fixes run as persistent thread transcripts you can watch, interrupt, and audit.
- Every monitoring evaluation is a recorded check run; metric-backed series keep the exact query behind them.

## Bounded by design

- Automatic investigations are capped per rolling 24 hours: 10 on Free, your own cap on paid plans.
- Agents pause at plan limits (warnings at 70% and 90%); overage is opt-in and stops at a cap you set.
- Monitoring acquires a rate-limit budget slot before calling your cloud provider's API and backs off when it's exhausted.

## Your infrastructure, on your terms

- Threads stay inside your workspace; public sharing is a separate, deliberate step.
- Public scan reports strip account, region, and connection identifiers; shared topology is display names only.
- Change records are retained 30 days or the most recent 5,000 per account; scan reports keep the 50 most recent per connection.
- Bring your own model: Team plans bring an LLM provider key (inference runs under your provider agreement); Enterprise adds a custom AI gateway, including self-hosted models.

Report vulnerabilities to boris@coreplane.ai (goes straight to the founder; response within two business days). Website privacy: https://polylane.com/privacy · Subprocessors: https://polylane.com/subprocessors