OdyshellThe identities and authority boundaries in agent-native Odyshell.
The isolation boundary for Humans, Agents, Machines, policies, Sessions, Commands, and audit evidence. OAuth clients and credentials are bound to exactly one Organization. A self-hosted deployment owns one sovereign Organization.
An Owner, Admin, or Supervisor who establishes trust and optionally intervenes. Humans do not need to drive Agent work. Owners and Admins manage the Organization; all three roles can approve or deny a Session that policy sends for review.
A persistent programmatic identity authenticated through OAuth. Authentication answers who the Agent is; it grants no Machine authority by itself. An Agent controls Sessions and Commands through the canonical HTTP API or the remote MCP adapter.
A customer-controlled Windows, Linux, or macOS host running an outbound Odyshell Client. Each Client Profile owns a Machine identity, an operating-system user, and a Local Policy enforced independently of the Server.
The Machine owner's hard ceiling covers Organization, concurrency, durations, output limits, and remote human approval. It never names Agents. The Server can grant less but never more.
Standard requires a Human decision for every Session. Operator bypasses explicit approval and
must be treated like granting the Agent SSH. Neither role can widen Local Policy.
Temporary authority binding one Agent, one Machine, one Client Profile, and one operating-system user. A Session is expiring, revocable, resumable by ID, and contains one or more asynchronous Commands up to its concurrency limit.
One arbitrary non-interactive shell execution inside an active Session. Input is limited to shell text, an optional absolute working directory, and a bounded timeout. There is no PTY, persistent shell, caller-provided environment, or standard input.
Durable evidence that binds identities and decisions to Session and Command lifecycle events. Command audit includes the exact command, working directory, timeout, status, timestamps, and bounded stdout/stderr. Credentials follow separate redaction rules and are never intended audit content.