Security objective
Authorize every action before execution and return verifiable evidence after execution.
Security by design
Security is built into the execution layer.
Myve executes actions server-side with policy gates, identity binding, and full traceability. This is execution control, not browser automation.
Security control rail
Control stance
Prompt text never executes directly. Schema validation and policy checks are mandatory gates.
Execution control matrix
How different integration approaches change risk exposure.
Control levelLow to High
UI scraping
Client agents
API only
Myve
- - Weak auth context
- - Selector fragility
- - Low auditability
- - Variable policy coverage
- - Execution ambiguity
- - Ownership gaps
- - Stronger access
- - Limited intent governance
- - Partial audit scope
- - Policy-enforced execution
- - Deterministic outcomes
- - Immutable trace evidence
Core controls
These controls are enforced at execution time, not added as after-the-fact monitoring.
Authentication and authorization
OAuth2, JWT, API keys, and optional mTLS at the execution boundary.
Policy enforcement
RBAC and ABAC decisioning before action mapping and execution.
Audit and accountability
Trace IDs, timestamps, actor binding, and decision context for each action.
Data handling
Minimal retained data by default with explicit retention controls.
Privacy principles
Privacy posture is set by architecture: constrained execution paths, no uncontrolled sessions, and minimal default retention.
- - No UI scraping in production workflows.
- - No credential sharing with third-party agents.
- - No uncontrolled browser sessions.
- - Scope-limited execution with explicit policy checks.
Compliance positioning
Built for teams that need defensible controls, clear boundaries, and auditable execution evidence.
Compliance posture
Designed for regulated workflows where auditability and authorization boundaries are mandatory.
Certification status
SOC2 and ISO alignment roadmap is in progress. No unsupported certification claims are made.
Threat model note
Prompt injection containment
Model output does not execute actions directly. Execution requires schema validity, policy allow, and explicit action mapping.
Security only matters when execution is controlled.
Myve keeps action execution inside your boundary with explicit authorization, deterministic behavior, and verifiable logs.