How Helmr keeps agent work in bounds.
Agents work with real repositories, credentials and internal systems. This page explains what Helmr isolates, who can act, what it records, and where its guarantees stop.
- 01Isolated computersEach agent works in a microVM defined in code.
- 02Keys outside the agentProtected secrets reach only the origins you allow.
- 03Scoped accessRoles for the organization, an environment or one agent.
- 04Decisions on recordWho acted, what Helmr checked, and what it refused.
- 05Your networkRun in your AWS account, privately if you need to.
- 06Open sourceApache 2.0. Read every boundary in the source.
01 · Isolation
Where agent work runs
Agents and their commands run inside a Linux microVM on a worker. The computer is defined in code (image, tools, resources, secret bindings and a prepare step), so what runs is reviewable and the same for every session.
Builds treat package install scripts as untrusted input. They run isolated, receive only the build secrets you select, and get no host Docker socket or unrestricted host filesystem.
- Between environments
- Separate authority, secret bindings and audit scope.
- Inside one environment
- Agent code is mutually trusted. Sessions that share a computer share its files and processes.
02 · Credentials
Credentials
Bind a secret as protected and the VM holds only a placeholder. Helmr substitutes the real value at the network boundary for HTTPS origins you allow, and fails the request once the secret is revoked. Reading a secret returns its metadata, never the value.
Raw environment variables and files expose values to processes in the computer; use them only where a tool cannot work through a protected binding.
Secrets →03 · Access
Who can act
Roles are sets of permissions granted to members, groups and API keys at organization, environment or single-agent scope. Standard roles cover common jobs; custom roles hold exactly the permissions you choose.
- Members and groups
- Each member’s access shows every permission and the assignment it comes from.
- API keys
- Belong to one environment and get nothing until a role is assigned.
- Organization owner
- Ownership alone grants no ordinary access, including audit access.
- Answers to agents
- Answering an agent’s question requires authority, and Helmr records who answered.
04 · Audit
What is recorded
Helmr records the operations it enforces, with the identity that acted, how it signed in and every authority check it evaluated. Refused requests are recorded too.
Recorded
- Sign-ins and administrative changes
- Session, turn and command transitions
- Secrets made available to a computer
- Refused requests and the reason
- Reading execution content or audit events
Never recorded
- Prompts and messages
- Command arguments and output
- File contents
- Tokens and secret values
Who can read it
Reading audit events needs its own permission, granted with the Auditor role for the organization or an environment. Every search is itself recorded.
How long it is kept
Retention is a finite period the operator sets; there is no unlimited mode. The serving process can only add and read audit records; removing expired ones is a separate maintenance command.
Audit events →05 · Deployment
Where Helmr runs
Run the control plane and workers in your own AWS account. The private reference keeps the Console, CLI and API on an internal load balancer, sends platform traffic through a proxy you maintain, and connects to Slack outbound, with no public endpoint.
Private deployment →06 · Limits
What Helmr does not cover
Knowing where a guarantee stops matters as much as the guarantee.
- Agent tool internals
- Activity inside a native agent harness that does not pass through Helmr is not in the audit log.
- Untrusted code side by side
- Agents in one environment trust each other; Helmr does not isolate them from one another.
- Log export
- The audit API is for investigation, not a loss-free collector or archive.
- External side effects
- Retries reconcile delivery; they do not make external actions happen exactly once.
- Erasure
- Expired records are hidden immediately; secure physical erasure is not promised.
07 · Open source
Read the source
Helmr is Apache 2.0. Every boundary on this page is in the source, so you can verify it before you trust it with your repositories.
helmrdotdev/helmr on GitHub →