Agentic Fungi is built on one rule every grower knows: nothing reaches the culture unsterilized. Your strains can think, plan, and propose anything — but the only thing that turns a proposal into a real change on your infrastructure is a human, holding a passkey, passing it through the Autoclave. Here is every layer, honestly.
See the layers ↓There is no contaminated side door. Not for a strain, not for a stolen token, not for the platform itself.
Each one is a real GCP control — and each one is here for a reason we can name.
Strains never execute privileged work directly. They stage a job to a queue; it only runs after a human sterilizes it. When we built this, the Builder strain itself refused to sterilize its own deploy — "I propose; the human sterilizes." That property is proven live, not aspirational.
Approvals are authorized with WebAuthn / passkeys, bound to your device's biometrics. The first device is enrolled with a one-time setup password that is then permanently disabled; every additional device must be added from an already-trusted one. Destructive commands trigger a second, explicit Face-ID confirmation.
When you sterilize a job, it executes under your Google identity via a short-lived OAuth token, valid only inside a 12-hour "ops window" you open with a click and end on logout. There is no always-on service account with god powers sitting in the project waiting to be stolen.
The strains and runners that do the day-to-day work are scoped to exactly what they need — typically datastore.user plus read access to a single secret — and nothing more. The scheduler that wakes them can only invoke one service. No component is a project owner; none can re-grow the platform.
Container images ship code and tools only, zero secrets. Credentials are pulled from Google Secret Manager at runtime and injected as needed. The open-source release provisions an empty secret slot; you drop in your own. Nothing sensitive is ever baked into a layer that could be pulled and cracked.
The harness is a proper OAuth 2.1 resource server: authorization-code + PKCE, dynamic client registration, discovery documents, Google-delegated login. Each strain's identity is derived from a validated token, server-side — so a strain can't simply claim to be another. An early version once carried a token in a URL where it could leak; fixing that reframed the entire model. A mislabeled jar is contamination; pure-culture identity is the fix.
Every deploy verifies the source against a known SHA before it grows, passes a type-check gate, and is additive — new capability is layered in without disturbing what already works. If a build fails, the previous culture keeps serving. No outages, no "how did prod change?" mysteries.
Security theater is telling you everything is green. We publish a real posture — including the edges we're still hardening — because a threat model you can trust is worth more than one that flatters us.
| Property | Status | What that means |
|---|---|---|
| No unsterilized path to root | Enforced | Privileged actions require a human passkey through the Autoclave. Proven live. |
| Pure-culture strain identity | Enforced | Identity derived from a validated token; strains can't be spoofed. |
| Least-privilege strains | Enforced | Strains/schedulers scoped to the job; no owner-level access. |
| Secrets never in images | Enforced | Runtime injection from Secret Manager; bring-your-own-credential. |
| The Autoclave is the whole boundary | By design | Once you sterilize, the executor runs what you approved as you. That power is why the passkey commit is non-negotiable — read the command before you tap. |
| Rate limiting on the harness | Operator-set | Bring your own quotas and budget alerts; we ship the guidance, you own the ceilings. |
| Credential leak resilience | Mitigated | Short-lived, revocable identity limits exposure — but rotate promptly if a device is lost. |
Written to survive a real security review — the same threat model ships in the repository so you can audit it yourself.
That's the whole point of Agentic Fungi. Real autonomy for the thinking, planning, and proposing. A human on the sterilizer for anything that touches your cloud. Read the code when it ships, or start with the model.
