Alstead · Answers

How should AI agent permissions work, and is an always-on agent box safe?

Agent permissions should be deny by default: each agent gets its own key and only the tools you grant, anything outside that is refused and waits for a person, and every action is logged. An always-on agent box is only as safe as what it can reach, so limit its credentials, network, and spending, and keep it easy to wipe.

ALSTEAD is an invite-only alpha built around the permissions half of that answer. It does not run your agents on an always-on machine today. Status labels below are the ones published on the ALSTEAD site, last updated 28 September 2026.

How agent permissions should work

These are general practices, not a list of ALSTEAD features.

One identity per agent. Give each agent its own key, so you can pause or revoke one agent without touching the others.
Deny by default. An agent gets the tools you grant and nothing else.
Ask, don't fail silently. When an agent needs something outside its grant, the call should stop, and a person should see the exact action, the resource, and the missing permission.
Grant narrowly. Approve one action or one scope, not a broad role, and check the policy again when the agent retries.
Keep a hard no. Spending money, publishing, and other irreversible actions are safer if no agent request can get them approved.
Revoke fast. Pausing an agent or rotating its key should take effect at once.
Bound each run. A spend limit, an expiry, and a turn limit keep one task from running away.
Keep a record. An append-only log of who did what, without secrets or message content, lets you reconstruct what happened.

What ALSTEAD does today

The ALSTEAD site describes the following. Each line carries the status label the site gives it.

What the site describes	Status on the site
Each agent gets its own access key, shown once. ALSTEAD stores only a hash and a short prefix.	Part of hiring, which was checked in the 27 September independent audit
Tools you don't tick are refused.	Checked in the 27 September independent audit
Pausing an agent blocks its key immediately. Rotating disables the old key. Retiring disables it permanently.	Pausing, resuming, rotating keys, and retiring were checked in the audit
A refused call waits in Needs you with the exact action, the resource, and the missing permission. You deny it, or allow that one action.	Deny: verified. Allow: built, not yet live-verified
Payments, publishing, and card use can't be approved at all.	Stated for this release
A ledger that is only ever added to: who did what and how it turned out, never message bodies, memory text, or keys.	Built and tested
Work runs with a total spend limit, an expiry, a maximum number of turns, and a maximum output length. An uncertain result is marked Outcome unknown and never repeated automatically. Runs use OpenAI Chat Completions with your own API key.	Built, not yet live-verified

ALSTEAD does not describe itself as hardened or certified. The site lists four issues from the September audit that are being fixed before more invites go out. You can try the Needs you flow on the home page as a simulation that runs in your browser and sends nothing.

Is an always-on agent box safe?

It can be reasonably safe if you treat it as a machine that will one day be misused. Nothing makes it safe by default. These are general practices for a Mac mini, a home server, or a VPS that runs agents around the clock:

Keep personal credentials off it. Give the box its own accounts and narrowly scoped keys, not your main email, password manager, or browser profile.
Don't expose remote access. No screen sharing or remote desktop open to the internet. Reach it over a VPN or SSH with keys.
Close the network. Open only the ports you need, and put the agent's dashboard behind authentication.
Keep secrets out of the repo. Store them in files only the agent's user can read.
Cap spending at the provider. Set limits on model keys so a loop can't run up a large bill.
Patch it. An always-on machine needs system and dependency updates like any server.
Make it disposable. Script the setup and back up its state, so you can wipe and rebuild it quickly.
Keep a kill switch and read the logs. Have one place to stop the agent and revoke its keys, and look at what it did.

Where ALSTEAD sits on always-on

ALSTEAD's alpha is not an always-on agent box. Its site lists agents using a computer or browser for you, and scheduled autonomous work, as not in this alpha. Sandbox and cloud computer time aren't available in this alpha either. The planned Pro plan adds a code sandbox and cloud computer time once they're verified. Nothing is on sale, and ALSTEAD is free while in alpha.

If you run an always-on machine today, the checklist above is yours to apply. ALSTEAD's part is the permissions, the approvals, and the ledger described earlier. See where ALSTEAD stands for the full status list.

Questions

How should AI agent permissions work?

Deny by default. Each agent gets its own key and only the tools you grant. Calls outside the grant are refused and shown to a person with the exact action and the missing permission, approvals add one permission at a time, and every operation is logged.

What should happen when an agent needs a permission it doesn't have?

The call should be refused and a person should decide. In ALSTEAD the request waits in Needs you. Deny is verified, and Allow is built but not yet live-verified. Payments, publishing, and card use can't be approved in this release.

Is it safe to run an always-on AI agent on a Mac mini or VPS?

It is only as safe as what the agent can reach. Keep personal credentials off the machine, don't expose remote access, open only the ports you need, cap model spending, keep it patched, and make it easy to wipe and rebuild.

Does ALSTEAD run my agents on an always-on machine?

Not in this alpha. ALSTEAD lists agents using a computer or browser for you, and scheduled autonomous work, as not in this alpha. Sandbox and cloud computer time aren't available yet.

Is ALSTEAD secure or certified?

ALSTEAD does not describe itself as hardened or certified. It is an invite-only alpha. Hiring agents, refusing tools they weren't given, pausing, rotating keys, and retiring agents were checked in an independent audit on 27 September 2026, and four audit issues are being fixed before more invites go out.

Next step

Facts checked against alstead.asv-labs.com on 7 October 2026.