Advisory and protected mode

The same plans and approvals can exist in two very different OS-level threat models. The product must name that difference plainly.

Advisory mode today

vops enforces:

• session authentication and expiry;
• target, environment, operation and spend limits;
• capability policy;
• immutable plans and human approval;
• credential resolution inside the local controller;
• redaction and local audit;
• semantic tools without generic shell or raw provider API operations.

But the development client may still run as the user’s normal operating-system account. If that account can read ~/.config/vops/, invoke ssh or use the administrative CLI directly, the agent process may technically bypass the broker.

This is useful governance, not enforced isolation.

What protected mode must add

A protected launcher needs to start the agent where it cannot directly access:

• provider and watch credentials;
• SSH private keys and agents;
• application and registry secrets;
• the administrative vops CLI;
• unrestricted host networking;
• writable vops profile state.

The scoped MCP or broker connection becomes the only infrastructure path.

Protected mode also needs a clear lifecycle:

1. create the isolated environment;
2. inject only the short-lived session path;
3. run the intended repository with bounded filesystem access;
4. terminate the process and networking when the session ends;
5. preserve only the redacted audit and explicitly requested artifacts.

That launcher is not currently shipped.

Claims the UI and docs may make

Claim	Advisory	Protected
vops will not return raw provider credentials through its tools	Yes	Yes
vops policy gates brokered operations	Yes	Yes
the agent cannot bypass vops with local shell or files	No	Yes, when isolation is implemented and verified
revoking the vops session terminates every possible infrastructure path	No	Yes, if the isolated launcher owns the only path

Emergency response in advisory mode

If an agent’s behavior is unexpected:

vops agent session stop-all
vops keyring lock

Then:

1. stop the development client or shell process;
2. inspect agent operations and audit;
3. verify provider and host state with read-only commands;
4. rotate an underlying credential only if exposure is plausible;
5. preserve evidence before editing the local store.

Revoking the broker session and stopping the OS process are separate actions in advisory mode.