📦 WASM Sandbox vs Docker vs VM
Execution isolation is the most important defense when AI runs real code. Three levels of isolation, each with different trade-offs in security, complexity, and performance.
📌 Isolation Comparison
Choose based on your use case:
- •WASM: maximum isolation, no access to FS/network, minimal overhead — for code evaluation
- •Docker: good isolation, controlled access via volumes, low overhead — general use
- •VM: complete isolation with a hypervisor, high overhead — for compliance and critical data
- •None: blocklist + audit only—for strictly personal use on a dedicated machine
💡 Practical Tip
For a personal assistant in development, Docker with read-only volumes is the perfect balance: reasonable security with maximum convenience.
🚦 Approval Gates — 3 Levels
Approval gates are the human-in-the-loop of IronClaw. They define when Jarvis acts on its own and when it needs your explicit confirmation.
📌 The 3 Levels of Autonomy
Each level defines which actions require approval:
- •Level 1 - Read-only: only reads data, never writes. No confirmation. For public use.
- •Level 2 - Supervised: any write or execution requires confirmation via Telegram. Default for personal use.
- •Level 3 - Autonomous: pre-approved actions run without confirmation, but with a full audit trail. For well-defined routine tasks.
💡 Practical Tip
Use Level 2 as the default. For specific, well-defined tasks (e.g., daily backup), create an allowlist of actions that operate at Level 3.
🗺 The Complete IronClaw Stack
IronClaw it's not a feature — it's an architecture. Five independent layers that work together to create real, auditable protection.
📌 The 5 Layers in Detail
Each layer has a single responsibility:
- •L1 Blocklist: immediately rejects prohibited commands — O(1) cost
- •L2 Injection Detection: analyzes manipulation patterns — O(n) cost for the text
- •L3 Approval Gate: asks a human before high-impact actions — ~5s latency cost
- •L4 Sandbox: runs in an isolated environment — 50-200ms overhead
- •L5 Audit: records everything immutably — O(1) append cost
💡 Practical Tip
IronClaw adds ~200-300ms of total latency with all layers active. Imperceptible in conversations. For fast automation loops, consider disabling L3 with a granular allowlist.
📊 Monitoring and Alerts
Security without monitoring is blind defense. The audit_analyzer.py processes the log periodically and sends alerts when it detects suspicious patterns.
📌 Monitored Patterns
Anomalies that trigger alerts:
- •5+ injection attempts in 1 hour — possible active attack
- •Access to a path outside the sandbox — bypass attempt
- •More than 100 tool executions in 10 minutes — possible malicious loop
- •API cost above the threshold — possible billing DoS
- •Any repeated action='deny' — persistent bypass attempt
💡 Practical Tip
Set up Telegram alerts so Jarvis can notify you of anomalies. It’s recursive, but it works — use a separate channel for security alerts.
🧪 Testing Your Defenses
Untested defenses aren't defenses—they're wishful thinking. Red team Jarvis itself verifies that each layer works as expected against real attacks.
📌 Security Test Suite
Required tests after each change:
- •test_blocklist.py: tests 50+ variations of dangerous commands
- •test_injection.py: 20 known injection patterns
- •test_path_traversal.py: simple traversal, double encoding, symlinks
- •test_approval_gate.py: verifies that high-risk actions require confirmation
- •test_audit.py: verifies that the log captures all actions
💡 Practical Tip
Run the security suite as CI/CD. Any code change that breaks a security test should be blocked automatically.
📝 Security Playbook
Incidents happen. A documented playbook before the incident is the difference between a controlled response and panic.
📌 The 6 Playbook Steps
Incident response in order:
- •1. KILL SWITCH: python -m intelecto stop — disables immediately
- •2. PRESERVE: cp ~/.intelecto/audit.log /secure/backup/incident-$(date).log
- •3. ANALYZE: python audit_analyzer.py --mode forensic --output report.txt
- •4. REVOKE: revoke all potentially compromised API keys
- •5. RESTORE: python setup.py --restore /secure/clean-backup
- •6. POST-MORTEM: document what happened, how it was detected, and what changed
💡 Practical Tip
Practice the playbook in a test environment before you need to use it in production. You don't want to learn the commands during a real incident.
✅ Module 3.4 Summary
Next:
Track 4: Integrations