# CodePress security model

CodePress is designed to let agents do meaningful work without receiving unlimited access to a company or a user's browser session.

## Workspace boundaries

- A session starts with a bounded job, organization, user context, and workspace.
- Customer workspaces and organization data are separated.
- Agent-side execution does not receive direct database access or unrestricted internal network access.

## Tools and credentials

- Organizations deliberately connect repositories and integrations.
- Access checks apply before customer data is returned to users or agent tools.
- Approved connections can be used without exposing their raw passwords, API keys, or OAuth tokens to the agent.
- Connections can be revoked or removed by authorized users.

## Review and approval

- Code changes normally travel through branches and pull requests.
- Existing CI, branch protection, review, and merge controls remain in the workflow.
- Ambiguous or destructive decisions can require clarification or approval.
- The ability to read a resource does not imply permission to modify it.

## Evidence

CodePress retains session history and operational evidence so authorized users can review what an agent was asked to do, which tools it used, and what it delivered.

Read the complete public [CodePress security brief](https://codepress.dev/security).