Riposte
Menu

Treat the model
as untrusted.

Design invariants

Natural language can propose work. It cannot grant scope, mint approval, read secret values, or bypass the execution boundary. This page states the invariants the implementation is being built and tested against.

FLOW: model proposes → context is labeled and minimized → policy decides → approval binds the exact action → the executor enforces constraints → every outcome becomes evidence.

Deny on ambiguity

Unknown resource identity, invalid schema, stale approval, unsupported containment, or uncertain policy state stops or safely pauses the action.

Bind what was shown

Approvals bind actor, case, normalized action, resolved scope, risk, policy version, time, and executor audience. What you approve is exactly what may run.

Keep secrets opaque

The model receives handles and metadata. A broker injects secret values at the last responsible boundary, outside argv and ordinary logs.

Prove the terminal state

A tool's success string is not enough. Receipts, artifacts, cleanup, and audit commit determine success, failure, cancellation, or unknown.

02 / DATA AND PROVIDERS

Where your data is designed to go.

Riposte runs on your machine and works against your terminal. Model inference is the one place data can leave: which provider, which endpoint, and which data classes are part of explicit configuration, not silent defaults.

  • Provider profiles declare what a model may receive; local providers are a first-class design target.
  • Context is labeled and minimized before it reaches a provider.
  • Credentials are brokered handles with release policy, never ambient environment.
  • Tool egress is designed to be mediated, with destinations and budgets visible before network-touching actions run.

Exact provider support and tested data-handling profiles will be published with the first release. Until then no compatibility claims are made.

This website

riposte.no itself uses no third-party analytics, no cookies, and no tracking scripts. See the privacy note.

03 / LIMITS

What is not guaranteed.

Candor is part of the security posture. As of today, the honest list of limitations is simple:

  • No implementation guarantee is claimed on this site yet. The invariants above are design commitments that gate release, not tested public guarantees.
  • Containment strength will differ by operating system and deployment mode, and will be published per platform rather than as one checkmark.
  • Riposte cannot make an unsafe target, policy, tool, model, or operator harmless, and it does not replace authorization you are required to obtain.
Proof classes

When the product ships, claims on this site will be labeled by proof class: design intent, implemented, tested, evaluated, or independently assessed.