You choose the boundary.

Where Tailscale ends and TetherBound begins

Tailscale provides the private network and machine identity underneath the current design. TetherBound adds the application layer that decides which hosts an AI may reach, which access mode is active, how execution/output are bounded, and what audit metadata is recorded.

Both layers must allow the operation. A broad Tailscale rule does not automatically admit a host in TetherBound, and future hosted policy cannot override a local denial.

Bounded mode

Bounded mode is the default. The MCP surface exposes seven fixed read-only operations. Caller-provided conversation text does not become executable shell text. Exact service allowlists, strict host verification, request limits, command deadlines, and output limits reduce the blast radius further.

Operator mode

Operator mode is deliberately broader. When locally enabled, it adds operator_exec(host, command, cwd?) for arbitrary POSIX shell execution on admitted Linux hosts. The boundary moves outward from operation-level authorization to an explicitly admitted host + delegated OS account + time-bounded gateway lease.

TetherBound does not add sudo/root privileges. However, powerful existing account permissions—such as Docker daemon access—can be effectively root-equivalent and should be treated accordingly.

Current Linux trust path

ChatGPT / MCP client
   │ OpenAI Secure MCP Tunnel
   ▼
TetherBound gateway
   │ host admission
   │ Bounded or explicit Operator lease
   │ dedicated Tailscale identity
   ▼
Tailscale network + SSH policy
   ▼
Dedicated OS account

The gateway verifies Tailscale-distributed SSH host keys, rejects shared nodes by default, requires a known online Linux peer, bounds execution and output, and does not store reusable SSH private keys for the default Tailscale SSH path.

What TetherBound deliberately does not do

• No automatic root, Administrator, or LocalSystem elevation.
• No public SSH or MCP management port required by the default local path.
• No reusable human SSH private key stored in ChatGPT.
• No remote way to enable or renew Operator mode; activation is local.
• No raw command text or remote output written to gateway logs by default.
• No claim that arbitrary shell execution is harmless: Operator mode materially increases model-error and prompt-injection consequences.

Remote content is untrusted

Hostnames, logs, files, process arguments, repository content, and web responses can contain malicious or misleading instructions. In Bounded mode the operation surface limits what those instructions can induce. In Operator mode the delegated account/host boundary becomes the primary blast-radius control.

Future Agent trust path

AI client
   ▼
TetherBound Edge
   ▲
   │ tailnet-only session
   │ Tailscale source identity + mTLS
   │
TetherBound Agent
   ▼
Native OS capabilities

Windows and macOS are planned around an outbound Agent rather than reusable passwords or permanently exposing a generic remote-command service.

Cloud does not replace the local boundary

The proposed hosted product adds authentication, routing, policy management, health, and audit metadata. TetherBound Edge still performs the final local authorization decision. Hosted policy may narrow local access but cannot widen it.