LOCAL-FIRST · TRUST-GATED
A living Agent can become deeply useful only when its reach is understandable. NativeAgent keeps private state local and places sensitive capability behind explicit trust.
THE TRUST MODEL
Local-first is the starting point. One permission law, effect-time gates, signed mobile actions, domain verification, and durable receipts carry that principle into the places where the Agent can act.
Memory stores and embedding computation live on the Mac. The selected conversation provider receives relevant context to answer; connected services and private iCloud coordination have their own data paths. Local-first does not mean every conversation stays offline.
Each call is judged by four facts: what its tool declares it is (a read, a write, a send, or something destructive), the posture you chose in Trust, whether that integration is switched on, and who steered the turn. Full Mac acts. Work mode asks before sends or changes on your side. Safe changes nothing on your side. Your saved entries still bind.
Mac control, shell and git run under Full Mac only; Safe refuses them. Deleting a contact, a calendar event, or a reminder is always yours to approve, Full Mac included, and the agent cannot approve its own card for it. A permission card settles by itself once you grant it in System Settings.
Safe, Work mode, Builder, and Full Mac are the four Trust presets. Full Mac persists across restarts and updates until you change it. Apple privacy permissions remain separate. Supported, permitted, ready, and verified access are distinct states.
Verified agents you explicitly trust act as you. Peers retain separate credentials and conversations. A turn steered by a peer you have not marked trusted is judged as Work mode at most. Needed approval cards name the requester and appear in chat across Mac, iPhone, and Telegram.
Bot schedules and event triggers are unattended work and follow the live Autonomy policy and configured limits. Full Mac admits unattended work. A part woken by a signal with no turn behind it acts under the agent’s own autonomy, and a part is never woken by its own hand. Run once is an explicit request, and a missed run is recorded rather than silently replayed later.
Tools, skills, senses, and the agent’s own turn are parts it owns, one file each. Whatever a turn can do through the app, a part can do, under the same law; a part that needs approval waits for its card. A part can fetch as a signed-in connector without the credential leaving the app, and reaches Calendar, Reminders, Contacts, and files through the same gates every tool uses.
Every run of a part writes an outcome. When a kept version fails on every run through its own fault and the one before was clean, the app swaps back and tells the agent why; nothing is deleted. Disabled parts stay disabled; dropping one deletes its file.
Durable receipts and domain readback make important work reviewable and confirm the real effect before completion is recorded.
Taking over the Mac pauses the reply. It resumes when control returns, using fresh observations before acting. Keyboard activity is a content-free pulse; attention state is ephemeral.
Accessibility controls keep their real semantics. Where nothing has a name, the agent acts at a point of the picture it was handed, and the receipt says where the hand went. Pixel-only regions cannot be promoted into typing, selecting, toggling, or other invented meaning. No act lands on or passes under another app’s window floating over the one it is working in, and secret fields are boxed in the desktop picture.
The optional local activity watcher stores metadata only. Sending any activity-derived result to a cloud model requires a second explicit disclosure consent that policy can only make more restrictive.
FROM THOUGHT TO ACTION
The Agent understands what is being requested.
One law judges the call: what it is, your posture, the integration switch, and who steered.
Full Mac acts, Work mode asks, Safe changes nothing on your side; your saved entries still bind.
The owning domain reads back reality before completion is trusted.
CONNECTED BY CHOICE
NativeAgent can use model providers, research, GitHub, messaging channels, productivity services, Mac apps, and the visible browser when you configure them. The Mac runtime remains the center of identity, memory, work, and trust.
Provider keys and integration credentials remain Mac-local. Public Swift source and the signed, notarized NativeAgent 0.6.6 Mac release are live.
Read the current project statusTRUST THE SOURCE · VERIFY THE RELEASE
