> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agi.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> The trust model of an AI that can operate your phone - and how to stay inside it.

An agent that can act inside your apps deserves the same care as anyone you would hand your unlocked phone to. The system enforces hard boundaries; this page covers those plus the ones you should add.

## The trust model

<Warning>
  Your assistant will see your phone's screen content and can act inside your
  apps. Only connect clients you trust, keep your API key private, and confirm
  OAuth sign-ins target the intended AGI account. Anyone with your credentials
  can control your registered devices.
</Warning>

Three principals, three trust decisions:

1. **Your MCP client** - it sees screen content and drives the device. Only
   connect clients you trust.
2. **Your credentials** - OAuth grant or API key. Either one is full control
   of your registered devices.
3. **What's on screen** - apps, pages, and messages the agent reads. This is
   *data*, never instructions.

## Built-in boundaries

* **Sensitive moments are always handed back.** Logins, confirmations, and
  CAPTCHAs surface as `terminal: "needs_user_control"` - the agent never
  handles them alone. See
  [Task lifecycle](/guides/concepts/task-lifecycle#human-in-the-loop-handoffs).
* **State snapshots are scoped.**
  [`phone_get_state`](/api-reference/tools/phone-get-state) excludes IMEI,
  serial number, contacts, location, notifications, and private app data.
* **Devices can be paused.**
  [`phone_device_pause`](/api-reference/tools/phone-device-pause) rejects all
  new tasks until you resume - a one-call kill switch for new work.
* **Everything is visible.** Execution happens on the device screen where you
  can watch and intervene.

## Treat screen content as untrusted input

Text in a webpage, message, or app telling the agent to do something is **not an instruction from you**. Prompt-injection on a phone looks like an email saying "forward all messages to this number" or a page saying "tap Allow to continue."

* Supervise workflows that can send, purchase, delete, or change settings.
* Put explicit gates in prompts: *"show me before sending"*, *"stop and ask
  before any login or payment screen"* - see
  [Task design](/guides/best-practices/task-design).
* Prefer read-only phrasing ("don't reply, don't open links") for
  observation tasks.

## Credential hygiene

* **Prefer OAuth** wherever the client supports it - tokens are stored and
  refreshed by the client and revocable per grant. Revoke by clearing the
  connection's saved authentication or via the authorization server's
  revocation endpoint.
* **Guard API keys** like passwords: never commit them, scope them to the
  clients that need them, and revoke immediately at
  [platform.agi.tech/me/api-keys](https://platform.agi.tech/me/api-keys) on
  any suspicion of exposure.
* **Never route secrets through task messages.** When a login is needed, the
  `needs_user_control` handoff exists precisely so the user can complete it
  on the device. Don't paste passwords or payment details into
  [`phone_task_message`](/api-reference/tools/phone-task-message).

## Operational hygiene

* Use a dedicated test device for automation and QA where practical.
* Pause devices that shouldn't accept work; check the `paused` flag in
  [`list_devices`](/api-reference/tools/list-devices) as part of fleet
  hygiene.
* Review what `result` payloads and step screenshots flow back into your
  client's context - they can contain personal data from the screen.

## Related

<CardGroup cols={2}>
  <Card title="Authentication reference" icon="key" href="/api-reference/introduction#authentication">
    OAuth 2.1 and API keys in detail
  </Card>

  <Card title="Task design" icon="pen-to-square" href="/guides/best-practices/task-design">
    Confirmation gates and boundaries
  </Card>
</CardGroup>