An assistant that knows your life holds a lot of sensitive material: your goals, your contacts, your finances, your private notes. Keeping that safe can’t depend on anyone remembering to be careful, whether that’s you or the model. So LifeOS draws three lines once and has the system itself hold them.
What’s private
The system and your data live in two separate places. The framework, which anyone can see, sits in one folder. Your identity, goals, memory and history sit in another that the framework reads while it runs. The public release is generated from the framework folder alone, and a set of release gates scans every file for personal data, credentials and private paths before anything leaves the machine.
What the assistant may do unasked
There is one table that decides what the assistant can do on its own and what needs your yes. Editing its own rules and files is fine, short of loosening a safety gate, which always waits for you. Deploying a new design you haven’t seen, sending a message to another person, spending money or deleting something that can’t be regenerated all wait for you. Where the table can be enforced in code, a hook enforces it. Where it can’t, it’s written down in one place, and every other document points there.
What it trusts
Web pages, emails, documents and tool output are data. Instructions come only from you. If a page tells the assistant to ignore its rules or send your files somewhere, the assistant stops and tells you. After it reads untrusted content, any send, deploy or push stops at a permission prompt you have to answer, a run with nobody at the terminal is refused outright, and a security hook enforces both until your next message.
In practice
You ask the assistant to summarize a web page that contains hidden instructions to email your contacts. It summarizes the page, reports the injection attempt, and sends nothing. Even if the model had been fooled, the send would have stopped at a prompt asking you to approve it.