Documentation › Environments & safety

Environments & safety

Product guide· what the agent may do, and where

An agent that operates real applications has to be safe by construction. This page covers where it may act, what it may change, and the checks around every run.

The most important rule: the agent may only change data in a disposable environment. Shared instances are read-only to it; a write attempt is refused before it happens, and logged.

Environments

Console → Environments

An environment is one instance of an application. The seed creates three: ThalamusTrace shared (tt-shared) and disposable (tt-disposable), and Thalamus SRE shared (sre-shared).

Address and login: where runs and evaluations go, and the account the agent signs in with. The password is write-only: stored encrypted with the secrets master key and never shown again.
Disposable or shared: whether the agent may change data there.
Snapshot and reset (disposable only): save a good state, and return to it between runs or benchmark passes.
An environment with no address runs against the built-in practice site.

How-to: point an environment at a real instance →

Environments — address, login and the disposable flag for each instance.

What keeps runs safe

Built in

Beyond the disposable rule:

Approvals: high-risk skills pause for a person to approve before they run.
Leases: two agents can’t edit the same object at the same time.
Isolated sandboxes: each agent run gets its own browser sandbox, with an allow-list for where it may connect.
Tamper-evident traces: trace batches are hash-linked, so a changed record shows.
Encrypted secrets: environment logins are sealed with a master key kept apart from the data, and never shown again.
Clarify before acting: an ambiguous goal gets a question, not a guess.

Who does what

Roles

ThalamusCUA is used by people in different roles:

Task owners give goals, set constraints, approve sensitive actions and review results.
Application engineers onboard applications: briefs, selectors, skills.
Administrators manage identities, secrets, environments, models and retention. Only admins change the Configurator.
Automation developers build benchmarks and run the regression gate.
External systems submit goals through the API or triggers.