Trust & security

ACP sits in your agents’ runtime call path. That’s the whole point — and it’s also exactly why you should ask hard questions before routing production through anyone, including us. This page answers the seven we’d ask.

1. What ACP sees and stores

Every governed call writes one audit record. By default that record is metadata, not content: the tool name (Read, Bash.git, WebFetch.example.com), the acting identity, the policy decision and which rule made it, timestamp, latency, token counts and metered cost, the harness and its version, the working directory, session and call ids, the agent name, task label and delegation chain your harness reports, your email, the human-readable reason for the decision, and for web tools the hostname. If you enable PII scanning, the record also notes which PII types were seen — never the values.

Request and response content is off by default. Turning it on is a per-workspace choice on the console’s Logging page — Include inputs and Include outputs — and when on, previews are truncated to 1,500 characters; if your policy is set to redact or block, PII the scan finds is removed from the call’s decision record before it is written. Off means the field is absent from the record, not present and empty.

The hook also reads your local session transcript. Harnesses that pass a transcript_path on the hook payload (Claude Code does) keep a JSONL log of the session on your disk, and the hook reads it to report model usage for sessions that were not launched through an ACP launcher: at most 2 MB per call, and from each completed model turn only the model id, the message id, its timestamp and the token counts (input, output, cache read, cache creation). Message text in that file is never extracted or sent. The cost derived from those counts is an estimate at API list rates, not a metered charge; a session launched through claude-acp (or another *-acp launcher) is metered at the gateway instead, and for it the transcript is not read.

One exception, and we would rather name it than have you find it: when a policy requires a human to approve an action, up to 500 characters of that action’s arguments are stored with the approval request, so the approver can see what they are approving. That preview is not PII-redacted, it is included in the approval email or push sent to approvers, and the request record — preview included — is kept until the workspace is deleted.

• See exactly what we hold for you at any time: acp_audit from your agent, or the activity log.
• --local mode keeps everything on your own disk — no account, policy evaluated on-device, nothing leaves your machine at run time (the installer downloads the hook once). curl -sf https://agenticcontrolplane.com/install.sh | bash -s -- --local.
• Your connected credentials (OAuth tokens for GitHub, Slack, etc.) are encrypted with AES-256-GCM under KMS-managed keys, stored per user, per workspace.
• We never train models on your data, and never share it for training. Full detail in the Privacy Policy.
• Audit records are kept for 12 months, then deleted by an hourly job; Enterprise workspaces are kept indefinitely. Approval requests and session summaries are removed when the workspace is deleted. You can export session and agent data as CSV from the console.

The short version: we designed ACP so that trusting us requires trusting us with as little as possible.

2. What the installer writes to your machine

The installer puts a hook in front of every tool call your agents make. That is an intrusive thing to do, so here is the complete list, with no “and related configuration”.

Shared, once: ~/.acp/ — govern.mjs (the hook, readable source); decide.mjs, the decision engine the hook loads for its offline floors (written by the macOS/Linux installer — the Claude Code plugin bundles its own copy); the launchers under ~/.acp/bin/ (claude-acp, codex-acp and the rest, plus acp-update and acp-uninstall, acp-session-summary on macOS/Linux cloud installs, acp-probe.mjs on Windows); a cached copy of the uninstaller (uninstall.sh, or uninstall.ps1 on Windows); a .stale-notice timestamp; and credentials (your workspace key — created mode 600 on macOS and Linux; on Windows it carries your user profile’s default ACL). On macOS and Linux the hook entries call ~/.acp/govern.mjs directly; on Windows the installer also writes one small govern-<harness>.mjs shim per harness, which sets the harness name and loads govern.mjs. Plus one marked line adding ~/.acp/bin to PATH in your shell rc, or to your user PATH on Windows. At run time the hook adds lapse.log and transcript-offsets.json alongside.

Per harness we detect: a PreToolUse / PostToolUse hook entry in that harness’s own config (~/.claude/settings.json, ~/.cursor/hooks.json, ~/.codex/hooks.json, ~/.qwen/settings.json, ~/.openclaw/settings.json) and, where the harness reads MCP servers from a file (~/.cursor/mcp.json, ~/.qwen/settings.json), an acp entry under mcpServers. Beyond the hook entry: Codex gets [features], [mcp_servers.acp] and [model_providers.acp] sections in ~/.codex/config.toml; opencode a plugin file and a provider entry under ~/.config/opencode/; Grok Build a purpose-built hook under ~/.acp/hooks/grok-build/, its registration at ~/.grok/hooks/acp.json and a [model.acp] table in ~/.grok/config.toml; Antigravity the same kind of hook under ~/.acp/hooks/antigravity/, registered by merging an acp key into ~/.gemini/config/hooks.json; pi and Prime Agent one extension file each (~/.pi/agent/extensions/acp.ts, ~/.prime/agent/extensions/acp.ts); DeepSeek Harness a plugin added through its own plugin manager, recorded in its settings.yaml; Hermes a pip package (acp-hermes) in the environment that runs it. The cost X-ray provider blocks are written but never selected as a default — only the *-acp launchers select them. Existing entries in those files are preserved — we merge, never overwrite. One removal, in the other direction: on Claude Code, when the CLI supports plugins, the installer installs the agentic-control-plane marketplace plugin instead of a direct hook entry, and takes out any direct govern.mjs hook entries and the acp entry under mcpServers that an earlier install wrote, because the plugin carries both — otherwise every call would be governed and logged twice.

Instruction text, and we want to be blunt about this: we append a block to your agent-instruction files — ~/.claude/CLAUDE.md, ~/.codex/AGENTS.md, and the equivalent for other harnesses. It tells your agent to launch through claude-acp so model calls get priced. It is fenced in markers so you can find every instance:

<!-- acp:begin — Agentic Control Plane governance -->
…
<!-- acp:end -->

We append between those markers and never touch anything outside them. grep -rl "acp:begin" ~ finds every one. We do not write into your project repositories — only into per-user config directories.

Harnesses we did not detect can still be governed. Several agents read Claude- or Cursor-format hook configs for compatibility. If you have one of those, registering a hook for Claude Code or Cursor also governs it, and its calls appear in your audit labelled with the config they read rather than their own name. (Grok Build is one such agent, which is why both installers wire it directly — on macOS, Linux and Windows — rather than relying on that: its own hook is the one that decides, and its calls carry its own name.) We would rather say this here than have you find it in a log.

Removal is one command, and it ships with the install:

acp-uninstall              # or: curl -sf https://agenticcontrolplane.com/uninstall.sh | bash
acp-uninstall --dry-run    # show what it would touch, change nothing

It removes the hook entries and leaves your other hooks, strips the marker-fenced blocks and leaves everything you wrote around them, drops the MCP entries, the PATH line and ~/.acp — registrations first, so nothing is ever left pointing at a file that is gone. The script is cached on your disk at install time, so getting out never depends on us being reachable.

Your workspace and its history live server-side and are not deleted by removing the client. Deleting them is self-serve, under Settings → Your data in the console: export your data, delete a workspace, or delete your account outright — no request to us, no waiting on our approval. Deletion is permanent; we keep no backups of workspace data. The privacy policy sets out what each one removes and what survives.

3. What happens when ACP is unreachable

It depends on who is at the keyboard, and the hook decides that from the harness’s permission mode:

• An interactive session fails open. If the API is down, slow, or your key is rejected, the call is allowed and runs ungoverned; the hook says so in your session, writes the lapse to ~/.acp/lapse.log, and reports it on the next governed call so the gap shows in your audit trail rather than disappearing. An outage of ours must not become an outage of yours.
• An unattended agent fails closed. Background, subagent and API-tier calls are denied while policy cannot be consulted. Those are exactly the sessions with no human watching, and “run ungoverned until someone notices” is not an acceptable posture for them.
• A few floors apply either way. Catastrophic commands — recursive deletes outside the working directory, force-pushes, piping downloads into a shell, destructive SQL — are stopped or asked about by the hook itself, offline, in every tier. The floors live in decide.mjs, which the hook loads from ~/.acp/ (or from its own plugin directory on Claude Code); where that file is absent the hook still runs, but the floors do not.

There is no switch to change this posture in the canonical hook — the govern.mjs the installer fetches from the plugin repository, which is what every install gets while GitHub is reachable. One consequence worth knowing: harnesses run with permissions bypassed (bypassPermissions, always-approve) are treated as unattended, so a person driving an agent that way is in the fail-closed group.

The exception is the fallback hook. If GitHub cannot be reached at install time, the installer writes a bundled copy of the hook instead and says so on screen (bundled fallback). That copy fails open in every tier, has no offline floors, and honours a ~/.acp/failmode file (closed makes it deny instead). Running acp-update once GitHub is reachable replaces it with the canonical hook; the version line it prints (govern.mjs: old → new) shows which one you have.

4. What happens if we disappear

The uncomfortable question about any young vendor — so we answered it with architecture instead of promises:

• The enforcement layer is open source. The governance modules (identity, policy, limits, redaction, audit) are MIT-licensed npm packages. They run in your infrastructure, with or without us.
• Self-hosting is a supported path, not an enterprise upsell.
• Your audit data is exportable (CSV today, API always).

If we vanished tomorrow, your control plane keeps running and your data comes with you. Very few vendors in this category can say that; it’s the reason we built on open source.

5. Is anyone actually using this?

Yes — starting with us, on purpose. Our own production agents route every tool and model call through ACP. The counter on the homepage is a re-counted Firestore total of every call the gateway has recorded, ours and external, with its count date beside it. We publish what we learn from running it — a teardown of one dogfood window, what 285,000 of our own calls actually cost, and the loop tax it exposed — and every number on /data carries its snapshot date. We’d rather show you our audit trail than a logo wall we haven’t earned yet.

6. Security posture — what’s true today

What we do:

• Policy enforcement on every governed call, scoped to the acting user’s identity — audit-only (allow and log) by default, deny-by-default once you configure it.
• Encryption in transit (TLS) and at rest (Google Cloud infrastructure, us-central1); application-level AES-256-GCM for stored credentials.
• No passwords stored — authentication is delegated to Firebase Auth / your identity provider.
• Privacy-first analytics (self-hosted Plausible — no cookies, no cross-site tracking) on our own sites.
• Secret-scanning gates on our own code, and least-privilege keys for our own vendors. We hold ourselves to the model we sell.

What we don’t have yet — said plainly:

• We are not SOC 2 / ISO 27001 / HIPAA certified. What ACP provides today is the evidence layer those frameworks ask for: identity-attributed logs of every agent action, policy decisions, and redaction findings — audit exports built to serve as evidence in your own certification work.

Found a vulnerability? See /.well-known/security.txt — or email david@agenticcontrolplane.com. We don’t shoot messengers.

7. Who’s behind this

I’m David. I built ACP because my own production agents needed it: I wanted to see, control, and price every action they took, and nothing off the shelf sat in the call path and did all three. My agents have run through it ever since — every call on that homepage counter includes mine.

If you’re evaluating ACP for a team, I’ll answer the hard questions directly: book 30 minutes or email david@agenticcontrolplane.com.

The paper trail: Terms of Service · Privacy Policy · What is an Agentic Control Plane? · Pricing

curl -sf https://agenticcontrolplane.com/install.sh | bash

irm https://agenticcontrolplane.com/install.ps1 | iex