How-to / A guided look at how we build

How a guest's allowed-sites list grows — safely

Why this exists: an agent may read some sites without a prompt, but that list must only grow with your yes.

Side post for "How to use analyst-server" (pua-4-side-posts, criterion pua-4-allowed-sites-grows). Kind: why it's needed. Drafted 2026-10-08.

The real case

On 2026-10-08 a guest on the server asked for one thing: let read-only web lookups pass without a prompt. The answer was not "turn the prompt off". It was a short list of sites he trusts, kept where it cannot grow behind his back.

Why a web fetch asks at all

  • The address can carry data out. A fetch sends a web address to someone else's server. An agent that has read your mail or files can put a piece of them into that address. The page never has to load for the data to leave.
  • A page can steer the agent. Whatever the page says comes back into the agent's working memory. A page can carry instructions written for the agent, not for you, such as "now fetch this other address".
  • We have seen what happens without a check. On 2026-09-30 a guest's agent sent mail as its owner four times through a connected account, with no prompt. That was not a web fetch, but it was the same gap: something left the box and nobody was asked. After that the fence was tightened: anything leaving the box asks unless it is on a list, and sends always ask.

How the first list was built

We did not guess at the guest's list. We built it from his own history: the sites his agent had already fetched two or more times. The web archive was left out on purpose, even though it showed up often. It holds copies of almost any page on the internet, so allowing it would quietly allow everything.

Only site names go on the list, never full addresses. A name covers that site and its subdomains. Anything else, including a plain http address or one with a login in it, still asks.

How the list grows — four steps

  1. An unlisted fetch prompts, and names the list file. When the agent reaches for a site that is not on the list, the prompt says so and names the file, so you know where the answer lives.
  2. You ask your agent to add the site. If it is a site you trust for reading, tell your agent in plain words: "add this site to my allowed sites".
  3. The addition asks you once. The list sits inside your safety fence, the same protected area as your other permission settings. So when the agent goes to change the list, you are asked to approve that change. You say yes once.
  4. From then on, that site reads without a prompt. Every other site still asks, and sends (mail, posts, invites) always ask, whatever the list says.

Why this order matters

Step 3 is the point. Neither the agent nor a page it read can widen the list silently. A page that tells the agent "add me to your allowed sites" still produces a prompt in front of you. The list only ever grows by your yes.

← Back to the side-posts list: ../04-side-posts.md