Bounded by design.

Where Tailscale ends and TetherBound begins

Tailscale provides the private network and machine identity underneath the current design. TetherBound does not replace that security boundary. It adds a separate application layer that decides which hosts and typed operations an AI assistant may use, applies hard limits, normalizes results, and records audit metadata.

Both layers must allow the operation. A broad Tailscale rule does not automatically grant an MCP capability, and future hosted policy cannot override a local TetherBound denial.

What TetherBound deliberately does not provide

• No generic run_command tool.
• No unrestricted shell, PTY, PowerShell, WinRM, RDP, or arbitrary script endpoint in the read-only product.
• No SSH private key stored in ChatGPT or in the current gateway.
• No public SSH port required for the current Tailscale path.
• No automatic elevation to root, Administrator, or LocalSystem just for richer telemetry.
• No write action inferred directly from remote logs or other untrusted output.

Current Linux trust path

ChatGPT
   │ OpenAI Secure MCP Tunnel
   ▼
TetherBound gateway
   │ local host/tool policy
   │ dedicated Tailscale identity
   ▼
Tailscale network + SSH policy
   ▼
Dedicated non-root account

The gateway verifies Tailscale-distributed SSH host keys, rejects shared nodes by default, requires a known online Linux peer, bounds execution and output, and exposes only fixed read-only command builders.

Future Agent trust path

AI client
   ▼
TetherBound Edge
   ▲
   │ tailnet-only session
   │ Tailscale source identity + mTLS
   │
TetherBound Agent
   ▼
Native OS read APIs

Windows and macOS are planned around an outbound Agent instead of reusable passwords or a generic remote-command channel. The Agent path continues to use Tailscale as the private network while adding TetherBound's own agent identity and mTLS binding.

Cloud does not replace the local boundary

The proposed hosted product adds authentication, routing, policy management, health, and audit metadata. TetherBound Edge still performs the final local authorization decision. Hosted policy may narrow local access but cannot widen it.

Remote content is untrusted

Hostnames, logs, process arguments, and service descriptions can contain malicious or misleading text. TetherBound treats them as data, bounds their size, and does not turn remote output directly into future write actions.

Write actions come later

prepare → policy evaluation → human approval → execute immutable action

Arbitrary shell access remains out of scope. Each future action must be implemented as its own typed capability with its own authorization and audit semantics.