# Safety

How Silan asks before risky steps, how Stop Everything works, how passwords stay hidden from the agent, and what data stays on your Mac.

A phone holds someone's messages, money, photos and accounts. Silan's rules run inside the engine, so they apply to its own agent, to every connected AI app, to API keys, to flows and to schedules alike. No client can skip them.

## Approvals

One switch, in setup and in **Settings › Safety**: **Ask me before paying, sending, posting or deleting**. With it on, the agent stops and asks before it:

- pays, buys, orders, books, transfers or subscribes;
- sends or submits text outside a search box, including pressing Return or Send;
- posts or publishes;
- deletes, removes, erases, discards or clears;
- opens an app it has not used in this task, or installs one.

Silan reads the words on the button and the title of the screen in seven languages, so a button that is only a price asks under "pay", and "Erase All Content and Settings" asks under "delete". A tap on a tab bar never asks.

The ask card names the thing and the app: "tap the Book now button in SkyTrip on your iPhone". While the card waits, the phone stays free: you can use it by hand, and another task on another device goes on. If the screen changes before you answer, Silan sends nothing and tells the agent to look again.

You pick how far a yes reaches:

| Choice | Covers |
|---|---|
| Just this once | This one step |
| For this chat | The same kind of step in the same app on the same device, for the rest of this chat |
| App for 1 hour | The same kind of step in that app on that device, from any chat, for one hour |

**Allowed for now** in Settings › Safety lists the answers Silan remembers. Remove one and Silan asks again. A connected AI app's answers are its own and never reach Silan's agent or another app.

With the switch off, the row says "The agent will act without asking." A deny still denies, and a Vault item's own ask stays.

Over the APIs, a risky step returns `APPROVAL_REQUIRED` (MCP), `202` with an approval (REST) or a `500` (WebDriver) until you say yes in Silan or with `silan approvals approve`.

## Stop Everything

Press Control Option Command Period anywhere on the Mac, or the **Stop Everything** button in the app, or run `silan stop`. Every action on every device stops at once. Every agent task and every run is held where it is, with its devices. **Resume** lets them go on from there.

Stop Everything is never limited by a plan or a setting, and no client can turn it off.

## Passwords and the Vault

The agent never sees a password, and it never types into a password box itself: typing into a secure field is refused for every actor but you.

- **Vault** (Settings › Vault) keeps passwords, keys and codes in your Mac's keychain. Each item has a name, a note for the agent, the apps it may go into, and when Silan asks (every time, once per chat, or not). The agent asks for an item by name with `fill_credential`; the chat shows "Typed NAME, from your Vault, value hidden". A password goes only into a password box.
- **1Password and Bitwarden** work the same way through their command-line tools, including one-time codes, which are an opt-in per site.
- **Hand the login to you**: `request_person_login` pauses the agent, you sign in on the phone, and the agent goes on when you hand the device back.

Masked text on the screen ("••••1234") reaches the agent as four dots only. The agent's screenshots and the screen recordings mask password fields.

## Taking over

In the app, **Take over** gives you the device while the agent waits; **Hand back** returns it. On an iPhone or iPad with the Developer way, holding both volume buttons takes control back on the device itself (in testing).

## Who may use your devices

- A connected AI app is named from the code signature of the program that started it. On its first tool call Silan asks you: **Allow**, **Allow this time** or **Don't allow**. Each app gets its own grant, and the Connections page shows what it did on which device and when.
- An API key is scoped to devices, a tool profile and a policy profile, and expires when you say.
- A lease makes a device one agent's for a time. Another agent gets `DEVICE_LEASED` and can wait for it.
- Every action, approval, key and setting change is an Activity row on the Mac, with who did it.

## What stays on your Mac

- The engine listens on 127.0.0.1 and ::1 only. Nothing on your network reaches it without a relay you set up.
- Chats, steps, pictures, flows, runs and reports are files under `~/Library/Application Support/Silan`. Model keys, Vault items and API keys are in your login keychain.
- Pictures go to the AI provider you chose for Silan's chat, and to any AI app you connected, as part of each step. Password fields are masked first.
- Team sharing goes through a relay that routes only sealed packets it cannot open, and only between Macs whose people share a team. The relay's log keeps counters, not ids, names, emails or addresses. See [Teams and self-hosted relay](/self-host/).
- A daily spending cap on model cost can be set for Silan's own agent.

Uninstall from **Help › Uninstall Silan…**. It names what it removes and asks first; your data is removed only when you tick that box.