Academy
8. Safety Model and Operational Best Practices
Review the full safety chain — data locality, anchor scoping, revocable grants, remote-access defaults, credit billing, and connection revocation — and apply best practices to a real deployment scenario.
The Nexus One safety model rests on a single principle: data processed on the device stays on it, and only the results you explicitly allow — artifacts and answers — travel back to the platform. This is the foundation of data locality. Every other safety mechanism layers on top of it: anchors scope what missions can see, grants control what @oupi can do, remote access is off by default, and every action is revocable from the console. Understanding how these layers interact is what separates a secure deployment from a misconfigured one.
Anchors are the first access-control boundary. An anchor is a folder on the device that you explicitly expose to OUPI. Missions can only read and write inside anchored folders; everything else on the device remains invisible. You add or remove anchors from the console at any time, so scope can be tightened mid-deployment without re-pairing. Best practice: anchor the narrowest directory that satisfies the mission's needs. Never anchor a root or home directory — treat anchors like firewall rules, not convenience shortcuts.
Grants are the second boundary. You grant capabilities to @oupi per device or per group — read anchors, run skills, produce artifacts. The default posture is 'entire fleet sovereign': nothing is granted until you decide. This means a freshly paired device is inert from the platform's perspective. Group your devices (e.g., 'Workshop', 'Site A') to manage rights in bulk, but review per-device overrides regularly. Revoke a grant the moment a project ends or a device changes role. Grants and anchors together form a least-privilege model: anchors define where, grants define what.
Remote access opens a secure tunnel to the device, protected by your OUPI login — but it is off by default. Enable it only on devices you genuinely need to reach from outside your premises, and disable it as soon as the session ends. 'Authorize local login' is a separate mechanism: when someone is physically at the device, it displays a six-character code they must enter to authenticate. This prevents unauthorized local use even if the device is physically accessible. Both settings are per-device and toggled from the console.
Credits for work performed on a Nexus One are debited from your OUPI account, just like any other action on the platform. This applies regardless of which connection surface triggers the work. Because every connection — browser extension, desktop app, device — draws from the same credit pool, monitor usage across all surfaces in 'My connections'. Each connection is scoped and revocable; revoke any connection you no longer use to prevent unintended credit consumption and close an unnecessary access path.
After pairing a new Nexus One, leave it in its default sovereign state while you plan anchors and grants. Pair first, then scope anchors to the exact folders needed, then grant only the capabilities required. This three-step sequence — pair → anchor → grant — prevents accidental exposure during setup.
Open 'My connections' and select one of your Nexus One devices. In its console, review the current anchors: are any broader than necessary? Remove or narrow at least one. Then check remote access — if it is enabled without an active need, disable it. Finally, review the grants for that device and revoke any capability no longer required by a running mission.
The Nexus One safety chain has five layers: (1) data locality — files never leave the device, only results do; (2) anchor scoping — missions see only exposed folders; (3) revocable grants — capabilities are opt-in per device or group, default is sovereign; (4) remote-access defaults — tunnel and local login are off until you enable them; (5) unified credit billing across all surfaces, with every connection revocable from 'My connections'. Apply least privilege at every layer, and audit regularly.