How SAFA Works — Secure Access for Agents

How SAFA Works — Secure Access for AgentsThe Agent sees the task. SAFA handles the secret. SAFA is a local security boundary for infrastructure work: an Agent can discover a registered resource, reason over its topology, and request one bounded operation without receiving the password, private key, token, or protected route behind it.The five-layer request flow

You describe the problem — no IP or password needed.

The Skill discovers the registered alias and asks the topology surface for placement, path, or impact.

Policy narrows the action to one resource, command, scope, and expiry.

Your Mac authorizes: macOS shows the exact action before Touch ID approval when user presence is required.

Evidence comes back: the Runtime executes, bounds, redacts, and labels remote output as untrusted evidence.

Credential isolationCredentials never cross into the Agent-visible channel. Open source does not mean open secrets: the code is public; Keychain records, vault keys, host routes, and authorization decisions are local runtime state.Security invariants

No credential return path: the Agent-facing contract has no command for showing or exporting a stored secret.

Remote output is untrusted evidence, not instructions or authorization.

Verification fails closed: signature, runtime, host identity, or policy failure does not fall back to raw SSH.

Scope stays explicit: bounded, non-sudo argument execution only — not an unrestricted shell.