One governed request crosses one gate.
LaunchZero checks requests through monitored tools and managed integrations, holds them when effective policy requires your decision, and binds approval to the matching action.
Proposed
Write notes.md
Monitored toolFilesystem.WriteText
The path and content are part of the exact request.
Decision gate
posture-writes-require-approval
- AllowRuns without review
- Require ApprovalPauses for your decisionThis request
- DenyStops before execution
Your decision
Review the same path, content, agent, and policy rule.
Approve exact action · Deny request
A canonical hash binds this approval to this exact action.
Submit for Execution
GatewayServer issues a one-time capability token for the matching action.
Executed
Executor runs the matching write once.
GatewayServer decides; Executor runs. Neither component can do both.
Audit receipt
Approved · hash matched · executed
The correlation ID carries the same action through policy, approval, and result.
unbroken chain
Why can’t the agent go around LaunchZero?
Monitoring alone tells you what happened after the fact. For monitored tools and LaunchZero-managed integrations, LaunchZero interposes before execution: effective policy resolves the request to Allow, Require approval, or Deny, and Activity records the result.
In managed agent configurations, named native filesystem, runtime, and web-fetch built-ins are blocked so corresponding requests use monitored tools. Model-provider traffic, existing foreign MCP entries, and disclosed direct capabilities remain outside this mediation boundary. The capability view is on the features page.
- Agent intent
- Monitored tool
- Policy gate
- Authorized execution
Why are deciding and executing separate?
LaunchZero separates decision from execution into two local processes. GatewayServer handles authentication, policy, approvals, and the decision record. Executor handles governed execution when it receives valid authority from GatewayServer. The separation keeps the decision and execution roles distinct; it does not make a compromised authorized issuer harmless.
A third local process, HostIntegrity, scores host and gateway integrity and looks for tamper signals. Your configured posture determines how those trust thresholds affect policy. See it on the features page.
What exactly did you approve?
When you approve an action, LaunchZero reduces it to a single canonical form and hashes it, then issues a one-time, short-lived execution capability for the matching action. At execution the action is re-hashed and runs only if it matches. An approval for one canonical action does not authorize a different action afterward.
LaunchZero does not try to judge every sentence as safe. It limits what untrusted instructions can do through governed tools. Canonical action hashing detects when the action submitted for governed execution differs from the action policy or a person approved. It does not determine whether the original request was wise or benign.
Exact-action binding
Approval follows the action, not a vague intention.
The action parameters, Approval ID, Correlation ID, policy reason, trust score, and canonical hash remain attached to the decision. Execution re-checks the canonical action, so the authority applies only to the matching request.
| Step | Action | Hash | Result |
|---|---|---|---|
| approved | launchzero_write_file report.md | a1f9…c0 | |
| execute | launchzero_write_file report.md | a1f9…c0 | match: allow |
| execute | launchzero_write_file ~/.ssh/authorized_keys | 7b3e…d2 | mismatch: deny |
What changes when policy or trust changes?
Effective policy governs monitored tools and LaunchZero-managed integrations. Managed integrations are registered behind per-tool policy proxies. Existing foreign MCP entries remain unchanged until you explicitly adopt or reinstall them through LaunchZero.
- Reads allowed
- Writes need approval
- Network restricted
The recommended Balanced posture, straight from the app.
One global control sits above every per-tool and per-integration rule - the security posture: Locked down, Balanced, Permissive, or Custom. Where a posture and a narrower rule disagree, the posture wins, so a permissive rule can’t widen a strict one. Under the recommended Balanced posture, unknown calls deny and selected writes and sends ask for approval. Effective policy determines the final outcome. A request through a monitored file or network tool can raise a runtime access grant when it reaches beyond an allowlist: allow it once or add an explicit, scoped durable grant.
LaunchZero-managed secrets stay inside their authorized path.
Keys managed through LaunchZero live in an encrypted, machine-bound store rather than plaintext LaunchZero-managed configuration. They are released only to authorized service identities, and provider credentials remain within the agent’s configured trust boundary. The agent-facing bridge is authenticated.
The execution result remains connected to the decision.
Governed decisions and executions are written to a local, hash-chained Activity record. Each entry is chained to the one before it, so a changed record breaks the chain and is detectable - the app reports “Audit log verified - N events - unbroken chain.” It is exportable and filters by category (Auth, Policy, Approvals, Execution, Tokens, Chat), outcome, and agent. The capability view is on the features page.
Where does the boundary end?
LaunchZero governs requests through monitored tools and LaunchZero-managed integrations. Its policy, approval, governed execution, and Activity path runs on your hardware, with no LaunchZero cloud in the enforcement path.
Model-provider traffic, existing foreign MCP entries, and disclosed direct capabilities remain outside this mediation boundary. LaunchZero does not replace operating-system security or vouch for model output.
Inside the boundary
- Requests through monitored tools and LaunchZero-managed integrations are mediated before governed execution.
- Policy evaluation, approvals, execution capabilities, action hashing, and Activity run locally on your machine.
- Decision and execution use separate local processes, and an approved action is bound to the matching canonical action before governed execution.
- LaunchZero-governed network tools can reach only hosts permitted by their allowlist and effective policy.
Outside the boundary
- LaunchZero is not antivirus or EDR. It governs what your agent does; it does not hunt for malware already on the host.
- It cannot make a fully compromised operating system safe. It relies on the host’s own cryptographic and process primitives.
- Model-provider traffic, existing foreign MCP entries, and disclosed direct capabilities remain outside LaunchZero’s mediation boundary.
- A broad Allow rule remains broad inside governed paths. Effective policy controls the outcome.
- It governs the agent’s actions, not the quality of its reasoning. A bad-but-permitted action is still a permitted action.
For source, release, maker, and disclosure evidence, continue to the Trust page. The capability view remains on Features.