The security boundary of an Enterprise Agent OS should not rest on vendor promises; it should be made of mechanisms. MagicFrog's security model is six facts, each backed by a product mechanism — not promises, contracts.
One: explicit target routing. Every browser, command, and file action names its target computerId. Missing ID, mismatch, revocation, or missing capability fails explicitly; resource handles stay bound to their original computerId and are never reused across machines.
Two: actions you can audit and answer. Every action answers two questions — which machine it landed on, and who approved it. Audit records are written in the same transaction as the operation, not added afterwards; the approved target is the machine that actually executes.
Three: credentials and encryption. Admin passwords are stored as argon2id in PHC form, and plaintext never touches storage; the workspace stays locked until the first-launch password change completes; model keys are BYOK and never ship inside the client build.
Four: network egress, fail-closed. The agent reaches internal systems through a client egress you authorize; dropped links, expiry, revocation, or a policy failure close the path — falling back to direct access is never allowed, and switching egress never reuses the old channel.
Five: device lifecycle. Existing computers and servers enroll with a single command; unenrolling revokes access only — no shutdown, no reinstall, no touching the machine's own data.
Six: data you own. Self-hosted deployments default to SQLite — the only required database — with data files on your own server; this site itself carries zero third-party tracking. Data ownership starts with not peeking yourself.
The full version lives on the security model page — verify each fact against the product yourself.