# Polylane security

> What agents can touch, what they can't, and every gate in between. Canonical: https://polylane.com/security

An agent with access to production should have to earn every write. Everything below is how the product actually behaves.

## Write access is earned, not assumed

- New cloud accounts connect read-only: write calls are refused until you turn read-only off, per account.
- Even with read-only off, every call that changes something still goes through a safety review.
- Code ships as pull requests: fixes land for your review, and Polylane merges only where you enable it.
- Over MCP and the CLI, write tools need the agent_tools:write scope and the x-polylane-allow-writes header; every write is then screened by a safety model.

## Least privilege, end to end

- Connections ask for the minimum: AWS via a scoped CloudFormation role, Cloudflare via pre-filled token permissions, GitHub and Sentry as apps.
- Provider credentials are encrypted with authenticated encryption before storage; agents never see them.
- API keys are workspace-scoped with explicit scopes, shown once; deletion is immediate.
- OAuth 2.0 with PKCE: 1-hour access tokens, single-use refresh tokens, immediate revocation.
- Workspace roles: owner, admin, member, read-only.
- Repository sandbox secrets are encrypted before storage.

## Evidence, not vibes

- Answers link back to the query, log line, or change record behind them; tool results stay in the transcript.
- A verdict without evidence falls back to inconclusive; an investigation that couldn't reach data never confirms.
- Investigations and fixes run as persistent thread transcripts you can watch, interrupt, and audit.
- Every monitoring evaluation is a recorded check run; metric-backed series keep the exact query behind them.

## Bounded by design

- Set a minimum severity, and confirmed issues below it wait for a person to start the investigation. You still get the verdict; only the work after it waits.
- Agents pause at plan limits (warnings at 70% and 90%); overage is opt-in and stops at a cap you set.
- Monitoring acquires a rate-limit budget slot before calling your cloud provider's API and backs off when it's exhausted.

## Your infrastructure, on your terms

- Threads stay inside your workspace; public sharing is a separate, deliberate step.
- Public reports strip account, region, and connection identifiers; shared topology is display names only.
- Change records are retained 30 days or the most recent 5,000 per account; reports keep the 50 most recent per connection.
- Bring your own model: use your own LLM provider key, and inference runs under your agreement with that provider. Which plans include it, and the custom AI gateway for self-hosted models, is on https://polylane.com/pricing.

Report vulnerabilities to security@polylane.com (goes straight to the founder; response within two business days). Website privacy: https://polylane.com/privacy · Subprocessors: https://polylane.com/subprocessors