Why the open posture has conditions Under auth.method none an agent inside one terminal reaches nginx over loopback and looks like a browser, so nginx would stamp a neighbour's secret and serve that terminal. Two things stand in the way: every persona's deny defaults on Bash, WebFetch, WebSearch and Playwright, refused at osprey up otherwise, and — defence in depth behind them — the python executor's socket guard, which refuses connections from executed code to the deployment's own web ports. UNDER THE OPEN POSTURE · FROM INSIDE, THE AGENT LOOKS LIKE A BROWSER DENIED REFUSED STAMPED alice's agent in its own container the agent's tools Bash · WebFetch · WebSearch · Playwright python executor host subprocess · no secrets in its env deny defaults every persona · else up refuses executor socket guard web-port connect() refused nginx can't tell agent from browser bob's terminal a neighbour's session, no login LEGEND a gate that holds defence in depth a route a loopback caller has what the gate refuses