Isolation

Isolation is the idea behind most of Lucy’s design. Each layer assumes the one before it could fail.

flowchart LR
  P[Person] --> A[Lucy API]
  A --> W[Worker]
  W --> S[Sandbox microVM]
  W --> B[Connector brokers]
  B --> X[Microsoft 365, Google, your MCP servers]
  W --> M[Model gateway]

Between customers

• Every record belongs to one organisation. The organisation comes from the person’s signed-in token, never from the request.
• A foreign ID is a 404. Asking for another organisation’s object behaves as if it does not exist, so nothing can be probed.
• Quotas are per organisation for sandboxes and for stored data, so one customer cannot crowd out another.

Between people in one organisation

• Conversations and files are private to their owner unless shared.
• Memory is scoped: only you, a group, or the organisation, and wider sharing needs an admin to accept it.
• Connectors are per person. Lucy uses your connection when you ask, never a colleague’s.
• Agents have their own identity and connections. An agent never borrows its owner’s mailbox.

Code runs in a sandbox, not on shared servers

A virtual machine of its own

Each conversation gets a microVM with its own kernel (Kata Containers with Firecracker), not a shared container. A flaw in one sandbox does not hand over the host.

No standing privileges

Code runs as an ordinary user with no root and no sudo, with hard limits on CPU and memory.

Nothing to steal

No secrets are placed in a sandbox. Connector tokens, keys and credentials are never inside it.

• Ephemeral. A sandbox is short-lived. After a few idle minutes it is saved (files only) and stopped. You can choose to keep nothing.
• No inbound connections. The only way to a sandbox is through Lucy’s API.
• Network walls. A sandbox cannot reach the platform’s own services, your company network, other sandboxes or the cluster. Internet access is off, allowlisted or open, per organisation.
• Fair use. Per-organisation limits on the number of sandboxes and the storage they use.

Published previews and files

• Private by default. A published page or file is private to its owner.
• Share links are signed and time-limited. Anyone with the link can open it, until it expires or you delete it.
• Separate web addresses, restrictive policy. Previews are served from their own hostnames under a content security policy that stops them from reaching back into the Lucy app.

Connectors and tokens

• Brokers hold the tokens. The services that talk to Microsoft 365 or Google keep the tokens and return only results. The model, the worker and the sandbox never see a token.
• Approval before anything leaves. Sending mail or creating an invitation shows an approval card with the full content. A card applies to exactly what you saw.
• Your own MCP servers are treated as untrusted. Only public https addresses are allowed, checked again at every connection so DNS cannot point inside. Calls are time limited and size limited, and a tool whose description or schema changes needs an admin review before it can be used freely.
• Servers learn nothing about you. A custom server receives only its own credentials and the call’s arguments.

Agents and untrusted input

• Unattended means more cautious. An agent cannot answer an approval, so anything set to ask is denied to it. It never gets tools on people’s computers.
• Input is data, not instructions. A webhook payload is passed to the agent inside a marked block that tells the model it is untrusted data.
• Outbound callbacks are guarded. Result callbacks go only to public https addresses, are signed, and are re-checked at connection time.
• Budgets and queues. Every run has limits on steps and time, a queue limit, and counts against allowances.

Prompt injection

No system can promise a model will never be misled by a malicious document. Lucy limits what a misled model can do:

1. It has few powers by default. Sensitive tools are off or set to ask.
2. Outward actions need your approval. Mail and invitations are shown first.
3. Code is walled in. Even a hostile file cannot reach your network or credentials from the sandbox.
4. Everything is logged. The audit log records connector use and approvals, with the actor.