Security and privacy

The work can move. Authority does not silently move with it.

Wagglet gives an agent only the product context and actions authorized for its exact workflow. Every credential has a named boundary—and sending work to an agent is still a deliberate disclosure that the human must understand.

Account boundary

Wagglet hands off tasks, not provider identities

The receiving teammate works through their own authenticated agent and remains responsible for the provider and company rules attached to that use.

A Task Handoff does not transfer a teammate's Claude, OpenAI, Google, or GitHub login.
It does not move an API key, subscription, usage allowance, credit, or token balance between people.
It does not make provider-prohibited account sharing or limit avoidance acceptable.
The runner still needs legitimate access to the repository, data, environment, and decisions required by the task.

Credential model

Different scopes use different credentials

The public skills contain no secret. A private capability is minted or shown only for the person and workflow that needs it.

Task read credential: Read-only, stored as a hash, rooted in one active claim, sent in an Authorization header, invalid when that claim ends, and limited to at most seven days.
Task delivery credential: Created later through Deliver for the exact task. It is separate from the starting read capability and files one delivery report rather than granting board access.
MCP Token: Shown once for one named MCP Connection and stored only as a hash. The connection belongs to one person and one Team, has no automatic expiry, and can be rotated or revoked.
Attachment access: MCP reauthorizes each attachment read. Task Handoff may return independent bearer links; a link already returned remains sensitive even after the read credential is revoked.

Current authority

Possession authenticates a connection; it never overrides permissions

The application remains the source of truth after a token is issued.

Every MCP request checks the connection, Team MCP setting, current membership, roles, effective permissions, and revocation state.
Disabling Team MCP Access rejects existing tokens immediately while preserving the connections so they remain visible and revocable.
MCP mutations use explicit lifecycle tools, current revisions, and connection-scoped operation ids instead of a generic status setter.
Stale revisions fail visibly. Revision-bound confirmations require the agent to show the impact and obtain human approval before continuing.
A successful MCP mutation keeps a minimal origin record; Wagglet's domain history remains the account of what actually changed.

Data boundary

Private does not mean merely hidden in the interface

Server-side product policy controls the records projected into Task Handoff, MCP, pages, and attachments.

Teams: Workspace data is isolated by Team. A person's current membership and permissions determine which Team records they may reach.
Private Drafts: Only their creator and collaborators can see them. Other people—including administrators and MCP callers—receive no Draft identity, count, relationship, or existence signal.
Human-only work: Its dormant agent prompt and Human instructions do not enter MCP views. MCP cannot deliver it or turn Human-only mode off.
Story traversal: Task Handoff rechecks live publication and Story membership. Linked published work may enter scope; moved or unlinked work leaves immediately.
Outcome analytics: Requires a dedicated permission and returns bounded Wagglet evidence. It is not arbitrary database access, and prose classifications remain agent inference.
Stored work: Tasks, Stories, requests, comments, delivery reports, attachments, and their histories are stored to run the service. Read the Privacy pagefor current storage and retention facts.

Deliberate disclosure

An agent cannot work on context it never receives

The honest security question is not whether task data leaves the page; it is whether the right person sends the right bounded data to the right agent for an authorized purpose.

A Task Handoff can include the task prompt, project and repository context, attachments, discussion, rework feedback, continuation context, and permitted related-work summaries. MCP can return records and attachments the connected person is currently authorized to read. The receiving agent or provider may then process that content under its own terms and the Team's policy.

Service facts

Operations, privacy, and honest limits

Security controls reduce risk; they are not a certification or a promise that software never fails.

Wagglet uses Google sign-in and does not store account passwords.
Application records and object storage are hosted on Railway; operational access is held by Rockbite Games.
Wagglet does not sell workspace data, share it with advertisers, or use it to train models.
The website uses the OpenAI advertising pixel only after measurement consent; see our privacy page for the data it receives.
The service does not claim a security or compliance certification it has not earned.

Report a suspected exposure, incorrect authorization result, or deletion request to [email protected]. Include the affected Wagglet surface and time, but do not send credentials or private task content by ordinary email.