# Security and privacy

The default posture is local-only, explicit, and fail-closed. No telemetry or
cloud inference is required. The network policy rejects unexpected outbound
model or tool traffic; optional model-fetch features remain user initiated.

```mermaid
flowchart TD
  R[User request] --> P{Permission gate}
  P -->|read| X[Execute locally]
  P -->|write / dangerous| C{Explicit confirmation?}
  C -->|yes| X
  C -->|no| B[Block and explain]
  X --> A[Audit metadata]
  X --> D[Return result]
  L[Lock screen] --> K[Revoke CU + mute overlay]
```

## Protected assets

- Microphone audio remains in a RAM ring buffer unless transcript retention is
  explicitly enabled.
- Screen frames remain in memory or temporary storage and are wiped on
  computer-use revoke by default.
- Computer-use audit logs store action metadata and screenshot hashes, not
  screenshots.
- Voice references, memory, and model caches are user-owned files.
- QVAC binds to localhost; bearer tokens, when used, come from user-owned
  configuration and are not logged.

## Filesystem access

Path tools default to the Jarvis workspace (`~/.local/share/jarvis-qvac` when
installed). Settings can widen that to your home directory or the entire
filesystem. This is still your user account: Jarvis does not gain root, and
writes plus shell commands still go through the confirmation gate.

## Computer-use controls

Computer use requires a spoken or HUD grant, shows a visible cursor/target, and
stops on revoke, Escape, lock screen, or grant expiry. It refuses password
fields, dangerous actions without confirmation, and actuation when the portal
or EIS backend is not ready. Legacy input is opt-in.

## Threat model boundaries

The daemon assumes the local user account and installed desktop libraries are
trusted. A malicious local process with access to the user's session bus or
filesystem is outside the protection boundary. Keep the repository and model
cache user-owned, use a restrictive token file mode, and avoid running the
daemon as root.