Five actions always ask
Send, buy, delete, post, and submitting personal data. Before any of them, Linda shows a card with exactly what will happen, and waits. You can approve from the notification too; on the Mac that asks for your password or Touch ID.
Enforced in code
The Gatekeeper checks every action the assistant takes, in the browser, in files, in connected apps and in commands. It uses fixed word lists in five languages, detects checkout pages and personal fields, and treats Enter in a message box as sending. No setting, web page, skill, plugin or prompt can turn it off, and tests may not weaken it.
Secure sign-in
When a site needs you to sign in, Linda shows a login card. What you type goes straight into the browser field. It never enters the chat, the assistant's context, logs or memory, and passwords are never sent to an online assistant.
The command sandbox
Some tasks are easiest with a little code. Linda runs it under macOS sandbox-exec with deny-by-default rules: an empty environment, only the task's own workspace writable, the task's folders read-only, ~/.ssh and Keychains denied, no network unless you approve it, and a 120-second limit.
Prompt injection
Web pages and emails can contain instructions aimed at assistants. Linda fences untrusted text, treats results from pages and apps as data, never saves them as facts, and runs a red-team suite (fake approvals, hidden sends, buy-now traps, data exfiltration, a planted IBAN) before changes ship.
Stop and take over
The Stop button halts a running task in any state. Take over brings the task's browser tab forward so you can do a step yourself. Voice can confirm an approval only while its card is on screen.