Security and governance
Built to answer for itself.Months later, in writing.
Everything on this page is a mechanism you can find in the product, not a promise in a policy. This is how an agent operated workspace stays something you can defend to a lawyer, an auditor, or your own team.
Rules for agents
Autonomy inside a fence it cannot climb.
The same four rules apply to Plutus, to any client you connect over MCP, and to code holding an API key. There is no privileged path and no house agent exception.
Approval gates where it matters
Seven of the nineteen actions cannot complete on their own. Creating, editing, and sending each stop and put the decision in front of a person with the authority to make it. An agent can assemble everything and still cannot cross that line alone.
Scopes, granted one at a time
Ten OAuth scopes cover the workspace, and a new connection starts with read access only. Write scopes are requested when an action genuinely needs one, and you decide at that moment, not in a blanket consent you clicked past on day one.
OAuth 2.1, never a pasted key
An MCP client registers, sends you to a consent screen, and comes back holding a token bound to your account and your grant. No secret sits in a config file waiting to be committed to the wrong repository.
Revocation that actually revokes
Every connected client is listed in settings with what it can do. Pull one, and its token stops working. The same goes for API keys and for any signing link you have sent.
Rules for documents
The document is the thing worth protecting.
Agreements outlive the software that produced them. These are the mechanisms that keep a PlutusDoc document trustworthy after it leaves the building.
One private link per recipient
Nobody shares an access route with anyone else, so the trail can say who did what without guessing. Any link can be pulled back the moment it should stop working.
Signatures fixed into the page
The finished PDF is flattened. What was signed is what stays signed, with no floating layer left behind for anyone to nudge afterwards.
Roles that bind agents too
Workspace permissions decide who can open, edit, and send. They apply to a connected agent exactly as they apply to the person who connected it.
A trail with addresses on it
Every view, download, signature, and agent action is recorded with the time, the IP address, and the device behind it, on the document it happened to.
Scoped keys, idempotent writes
API keys carry only the scopes you gave them, and write requests carry an idempotency key, so a retried call cannot quietly become a second send.
Deletion with a second thought
Deleted files rest in a recoverable bin rather than vanishing, and emptying it for good asks you to confirm your identity first.
The trail
One history, whoever made it.
An action run by an agent lands in the same record as one you ran with your own mouse, so the history of a document reads as one story rather than two. When someone asks what happened, you produce a trail, not a chat log.
The paperwork, and the front door.
How we collect, store, and delete data is written up in the privacy policy, and it is written to be read. And if you have found a weakness anywhere in PlutusDoc, we want to hear it from you before we hear it from anyone else.
Reports go straight to the people who can fix them.