Security

Honest boundaries, not marketing theater

Coordination only works if you know what is guaranteed. Here is how Managent thinks about enforcement, secrets, tenancy, and runtime isolation.

The enforcement stack

Managent is a self-hosted coordination service. The server is the referee for leases. Agents launched with managent run hit a Docker/bubblewrap FS boundary by default. Agents that are not wrapped that way are out of scope — wrap them, or out-of-territory writes can succeed and the product is pointless.

Hardened run (default)

managent run defaults to hardened isolation. Leased paths stay writable; the rest of the repo is read-only at the VFS/mount layer — chmod +w must not unlock writes. If Docker/bubblewrap is unavailable, the CLI fails closed unless you set labeled MANAGENT_ENFORCEMENT_INSECURE_DOWNGRADE=1 (never claimed as hardened).

New repos default to hard_fail: git hooks hard-block out-of-territory hunks, and managent enforce verify-pr / required GitHub checks reject bad landings — including after local --no-verify when the check is required.

What is still out of scope

Host root, remounts, and sibling processes that never entered via managent run are not policed. Kernel Landlock/Seatbelt beyond the supported Docker/bwrap path is roadmap, not claimed. Overlapping exclusive grants cannot be issued while leases are respected. Do not drop the respected-leases qualifier when talking about conflicts.

Opting down (observation)

You can set enforcement_level to advisory, warn, or shadow for deliberate observation. That is an opt-down from the fail-closed default — document it for your org. Soft coordination alone is not the supported agent path.

Local hooks vs land gate

managent hook install adds pre-commit / pre-push territory checks. Under hard_fail they exit 1 on out-of-territory hunks. Hooks remain bypassable with git commit --no-verify — that is why required PR verify exists.

PR verify closes the loop

managent enforce verify-pr and the required GitHub coordination check compare the actual diff to authorized territory. Under hard_fail, inconclusive evidence fail-closes. Local hook bypass does not bypass this gate when it is required — that is how you get “cannot land,” not merely “should not write.”

Merge-replay (git merge-tree) separately evidences whether coordinated PR pairs still merge cleanly. Conflicts are root-caused (scope_miss | lease_violation | structural) and fed back into scope prediction. Clean replays are evidence; empty pairs_checked is not proof.

No secrets in the client

API keys, portal tokens, webhook secrets, and license material stay server-side or in operator env. The marketing site never embeds Formspree endpoints, bearer tokens, or NEXT_PUBLIC_* credentials. Public forms proxy through validated, rate-limited server routes. Outbound fetches go through SSRF-safe helpers with HTTPS required in production. Agent API keys are stored as hashes; workspace sessions are HttpOnly cookies.

Tenancy and authz

Agent API keys are org-scoped, with optional per-key repo allowlists. Cross-tenant probes return 404, not 403 — no existence oracle for other orgs. Authorization lives on the server for every endpoint; UI role checks are never the gate. Rate limits apply to anonymous and authenticated traffic (IP buckets, key/session buckets, expensive budget for LLM / partition work) with 429 + Retry-After.

This page is a buyer-facing summary, not a certification. We do not claim SOC 2, ISO 27001, a completed third-party pen test, or multi-process HA. For mechanics and demos, see docs and demo.