# Security Model of OpenHuman: Autonomy Tiers, Approval Gates, and Command Classification

> Discover OpenHuman's robust security model featuring autonomy tiers command classification and approval gates to safeguard user data and operations. Learn how it enforces explicit consent for high-risk actions.

- Repository: [Tiny Humans/openhuman](https://github.com/tinyhumansai/openhuman)
- Tags: security-model
- Published: 2026-08-29

---

**OpenHuman protects users through a layered security model built into its Rust core, combining autonomy tiers that define baseline permissions, command classification that parses shell operations into risk categories, and approval gates that enforce explicit consent for elevated-risk actions.**

OpenHuman is an AI agent runtime that executes shell commands and file operations on behalf of users. To prevent unauthorized data access or system modification, the platform implements a defense-in-depth architecture defined in the source code at `tinyhumansai/openhuman`. The security model ensures that every tool invocation passes through classification, tier verification, and optional user approval before execution.

## Autonomy Tiers and Configuration

The foundation of OpenHuman’s security model is the **autonomy tier** system, which defines the default permission level for agent operations. The configuration schema lives in [`src/openhuman/config/schema/autonomy.rs`](https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/config/schema/autonomy.rs) and is exposed through the global `Config` object.

The `AutonomyLevel` enum defines three distinct tiers:

```rust
pub enum AutonomyLevel {
    ReadOnly,   // Only read-only operations are allowed
    Supervised, // Write and network operations require approval gate clearance
    Full,       // All operations allowed unless explicitly blocked
}

```

Each tier supports granular controls configured via the `autonomy` block:

- `level: AutonomyLevel` – Sets the base permission tier
- `workspace_only: bool` – Confines actions to the workspace directory when enabled
- `max_actions_per_hour: u32` – Implements rate limiting for tool usage
- `require_approval_for_medium_risk: bool` – Forces approval prompts for Write and Network commands
- `block_high_risk_commands: bool` – Automatically denies Destructive class operations

Users query or modify these settings at runtime through JSON-RPC methods implemented in [`src/openhuman/config/ops.rs`](https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/config/ops.rs):

- `openhuman.config_get_autonomy_settings`
- `openhuman.config_update_autonomy_settings`

## Command Classification System

Before any tool executes, OpenHuman parses the raw command string to determine its risk profile. The `SecurityPolicy::classify_command` function in [`src/openhuman/security/policy/command_checks.rs`](https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/security/policy/command_checks.rs) analyzes shell syntax, redirections, pipelines, and executable names to assign a `CommandClass`:

```rust
pub enum CommandClass {
    Read,        // e.g., cat file.txt
    Write,       // e.g., echo hi > out.txt or git operations
    Network,     // e.g., curl http://example.com
    Install,     // e.g., npm install (treated as Write for rate-limiting)
    Destructive, // e.g., rm -rf /, shutdown, reboot
}

```

The classifier treats shell redirections (`>`, `>>`, `|`) as **Write** operations due to their side effects. It normalizes command names—for example, mapping `git` to the Write category—and flags hidden execution patterns like `${VAR}` expansion combined with `tee` as potentially dangerous write operations.

## Approval Gates and Enforcement Flow

When a command’s classification exceeds the current autonomy tier’s permissions, the **approval gate** determines the final execution path. The enforcement logic resides in [`src/openhuman/security/policy/enforcement.rs`](https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/security/policy/enforcement.rs), specifically within `SecurityPolicy::enforce_tool_operation`.

The gate evaluates three possible outcomes:

1. **Allow** – The command passes automatically if `autonomy.auto_approve` is enabled and the risk level permits
2. **Prompt** – For medium-risk commands (Write or Network) when `require_approval_for_medium_risk` is true, the gate generates an `ApprovalRequest` containing the command description and timeout, suspending execution until the user responds via the UI
3. **Block** – High-risk Destructive commands are denied immediately when `block_high_risk_commands` is enabled

The decision logic is implemented in [`src/openhuman/security/approval/gate.rs`](https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/security/approval/gate.rs), which bridges the autonomy configuration and command classification to produce the final verdict.

## Runtime Guarantees and Sandboxing

OpenHuman implements multiple fail-safe mechanisms to ensure the security model cannot be bypassed:

- **Fail-closed default** – If classification or policy lookup fails, the system denies the operation rather than allowing potentially dangerous execution
- **Rate limiting** – The `max_actions_per_hour` field throttles tool usage across all autonomy tiers to prevent automated abuse
- **OS-level sandboxing** – Even allowed commands execute within restricted environments using Landlock (Linux) or Firejail (cross-platform), enforced by [`src/openhuman/security/landlock.rs`](https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/security/landlock.rs) and [`src/openhuman/security/firejail.rs`](https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/security/firejail.rs)
- **Comprehensive audit logging** – Every decision (Allow, Prompt, or Block) is recorded to the event bus via [`src/openhuman/security/audit.rs`](https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/security/audit.rs) for forensic analysis

## Practical Configuration Examples

The following Rust examples demonstrate how to interact with the security model programmatically:

Query the current autonomy settings:

```rust
let resp = core_rpc_client
    .call("openhuman.config_get_autonomy_settings", json!({}))
    .await?;
println!("Current tier: {}", resp["level"]); // Outputs: "Supervised"

```

Update to full autonomy with auto-approval:

```rust
core_rpc_client
    .call(
        "openhuman.config_update_autonomy_settings",
        json!({ "autonomy": { "level": "Full", "auto_approve": true } })
    )
    .await?;

```

Attempt a destructive command (will be blocked):

```rust
let tool_result = core_rpc_client
    .call("openhuman.tools_shell", json!({ "command": "rm -rf /tmp/foo" }))
    .await?;
assert_eq!(tool_result["status"], "error"); // Blocked as Destructive

```

Trigger a medium-risk approval request:

```rust
let tool_result = core_rpc_client
    .call("openhuman.tools_shell", json!({ "command": "echo hi > out.txt" }))
    .await?;
// Returns an ApprovalRequest ID; UI must approve before the write executes

```

## Summary

- OpenHuman’s security model consists of **autonomy tiers** (ReadOnly, Supervised, Full) defined in [`src/openhuman/config/schema/autonomy.rs`](https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/config/schema/autonomy.rs) that establish baseline permissions
- **Command classification** in [`src/openhuman/security/policy/command_checks.rs`](https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/security/policy/command_checks.rs) parses shell commands into risk categories (Read, Write, Network, Install, Destructive)
- **Approval gates** in [`src/openhuman/security/approval/gate.rs`](https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/security/approval/gate.rs) enforce user consent for medium-risk operations and block high-risk commands automatically
- The enforcement entry point `SecurityPolicy::enforce_tool_operation` in [`src/openhuman/security/policy/enforcement.rs`](https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/security/policy/enforcement.rs) orchestrates all security decisions
- Runtime guarantees include fail-closed defaults, rate limiting, OS-level sandboxing via Landlock/Firejail, and comprehensive audit logging
- Configuration is accessible through JSON-RPC methods `openhuman.config_get_autonomy_settings` and `openhuman.config_update_autonomy_settings`

## Frequently Asked Questions

### How does OpenHuman classify complex shell commands with pipes and redirections?

According to the source code in [`src/openhuman/security/policy/command_checks.rs`](https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/security/policy/command_checks.rs), the classifier treats any command containing shell redirections (`>`, `>>`) or pipes (`|`) as a **Write** operation, regardless of the primary executable. This conservative approach ensures that side effects like `cat file | tee output.txt` are properly flagged for approval gate review, preventing data exfiltration or modification through obfuscated command chains.

### What happens if the approval gate cannot reach the user interface?

The approval gate implements a **fail-closed** policy. If the system cannot generate an `ApprovalRequest` or the user interface fails to respond within the timeout window, the operation is automatically denied. As implemented in [`src/openhuman/security/approval/gate.rs`](https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/security/approval/gate.rs), this ensures that network interruptions or UI crashes never result in unauthorized high-risk command execution.

### Can autonomy settings be changed dynamically without restarting the agent?

Yes. OpenHuman exposes runtime configuration updates through the `openhuman.config_update_autonomy_settings` JSON-RPC method defined in [`src/openhuman/config/ops.rs`](https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/config/ops.rs). Agents can transition between ReadOnly, Supervised, and Full tiers, or toggle `auto_approve` flags, without restarting the core runtime. All changes take effect immediately for subsequent tool invocations.

### How does OpenHuman prevent catastrophic commands like `rm -rf /`?

Destructive commands are classified into the `Destructive` variant of the `CommandClass` enum. When `block_high_risk_commands` is enabled in the autonomy configuration, the approval gate in [`src/openhuman/security/approval/gate.rs`](https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/security/approval/gate.rs) automatically denies these operations before they reach the operating system. Additionally, even if classification fails, the sandbox layer ([`src/openhuman/security/landlock.rs`](https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/security/landlock.rs)) restricts filesystem access to the workspace directory, providing defense-in-depth against data loss.