Dawnstar Labs Vardhold Docs

Security model

An AI agent runs as the person using the PC, so it can reach anything that person can. Vardhold is designed from that starting point.

3 min readUpdated October 2026Vardhold 0.1 (pre-release)

On this page
  1. The starting assumption
  2. Two roles
  3. Confirmation the agent cannot give
  4. Fail closed
  5. Self-protection
  6. Careful with user files
  7. Prevention and detection, kept apart
  8. Enforcement aimed at agents only
  9. Local only
  10. Evidence
  11. Report a vulnerability

The starting assumption#

Agents run with the same Windows account as the developer, so Vardhold assumes that anything the user can reach, including the tray app, its windows and its memory, an agent can reach too. Every design choice below follows from that.

Two roles#

The tray app and dashboard hold a user role: they see everything and can make anything stricter, such as denying a request, engaging the kill switch, raising the mode or blocking an agent. Anything that loosens protection needs the administrator role, which only an elevated process can obtain:

  • allowing an action that was held for approval
  • lowering the mode or releasing the kill switch
  • trusting or unblocking an agent
  • applying a policy or changing settings

Confirmation the agent cannot give#

When a person clicks Allow, Windows shows a User Account Control prompt on the secure desktop, then an elevated Vardhold window states exactly what will change. Only Confirm in that window sends it. Programs running without elevation, agents included, cannot click or type into either. Deny stays one click.

Run AI agents under standard user accounts, or set UAC to Always notify, for the strongest separation between the agent and the person approving.

Fail closed#

If the service cannot be reached, the hook crashes or times out, or an approval is not answered in time, the action is blocked. The Claude Code and Cursor hooks are registered with their agents so that a hook failure blocks the action too. Administrators can choose otherwise, deliberately, in settings.

Self-protection#

  • The default policy stops agents from reading or changing Vardhold's files, its hook registrations and its service, and from turning off Windows Defender or the firewall.
  • On an installed machine, the hook, proxy and CLI take their configuration only from locations administrators control.
  • Vardhold's data folders belong to SYSTEM and Administrators. Anything placed in them before installation is taken over.
  • MCP configurations are re-checked every minute; a server that loses protection raises a high-severity alert.

Careful with user files#

The service runs as SYSTEM but edits MCP configurations in users' folders. It never follows a link there, never contacts a network location named in a user's configuration, and keeps its backups in its own folder rather than next to the user's file. Export credentials are encrypted with DPAPI and cannot be sent to a new destination without being entered again.

Prevention and detection, kept apart#

The hooks and the MCP proxy decide before an action runs, so they can stop it. Windows telemetry sees actions after they happen and raises alerts. Vardhold labels every event with its source, so nobody mistakes one for the other. Automatic suspension on a detection is an opt-in that applies only to headless agents.

Enforcement aimed at agents only#

Suspend, end and firewall actions go through one guard. System and security processes, shared runtimes and browsers, and Vardhold itself are refused. A protected name counts only for the genuine program, verified by location and signature, and every action re-checks that the process is still the one it meant.

Local only#

The API listens on 127.0.0.1, requires a token, and rejects requests with a foreign Host or Origin, which blocks DNS rebinding and cross-site requests. The dashboard is served with a strict Content Security Policy.

Evidence#

  • Every audit record is chained to the one before it with HMAC-SHA256 under a per-machine key, encrypted with Windows DPAPI and readable only by the service and administrators.
  • Approvals, alerts, retention checkpoints and policy versions are sealed with the same key, and a sealed record of the chain head and table sizes means removing the newest records is detected, not just editing them.
  • Every exported event carries its sequence number and chain hash, and the chain head is recorded hourly, so the SIEM holds an independent copy to check against.
  • Integrity is checked at start-up and daily; a failure raises a critical alert. Secrets are redacted before storage.

Report a vulnerability#

Email [email protected]. Please do not open public issues for security problems. Our disclosure details are in security.txt.