XR's capability-based security model

How we think about agent security, from sandboxing to human-in-the-loop confirmations, signed skills, and audit trails.

XR's security model separates authority from intelligence: a model proposes, but policy, identity, isolation, and approval grant.

Every consequential action flows through one execution envelope: intent, plan, policy decision, placement, action, observation, evidence, outcome.

Isolation follows risk. Low-risk work runs in-process; high-risk actions — shell, code, secrets, external writes — are placed in restricted or container isolation. In-process policy is a data boundary, not a security boundary.

The reviewer is fail-closed: it requires strict JSON, and anything unparseable is changes_requested, never silently approved.

The audit log is hash-chained and serialized, and can be verified with one command. XR is not certified by any third party and makes no SOC 2, ISO 27001, or HIPAA claim.