# Security and limits The controls that keep Devii safe and bounded. See also [Data and persistence](/docs/devii-data.html) and [Configuration and CLI](/docs/devii-config.html). ## Per-account memory isolation The self-learning lesson store is **owner-scoped and never shared**. Each session gets a `LessonStore` filtered by `(owner_kind, owner_id)` - the main DB for signed-in users, a private in-memory DB for guests. One account can never recall another account's lessons. The user can purge their own memory at any time with the `forget_lessons` tool (clear all, or only lessons matching a query). The system prompt forbids storing credentials, passwords, API keys, or secrets in a lesson. ## Spending limits Spend is capped per owner over a rolling 24 hours, read from `devii_usage_ledger` (the authoritative source). The caps are admin-configurable: `devii_user_daily_usd` and `devii_guest_daily_usd`. The cap is checked before each turn; a turn already over the limit is refused. Pricing is configurable (`devii_price_*`) and is applied per turn. ## JavaScript execution toggle The `client` handler can run JavaScript in the user's own browser (`run_js`) for live tutorials and demos. This is gated by the `devii_allow_eval` config field (default on); when off, `run_js` is refused while the other client tools (navigate, reload, highlight, toast, context) still work. ## Admin-only analytics Site-wide analytics is a documented, admin-secured HTTP endpoint - `GET /admin/analytics` (returns JSON, 403 for non-admins; see the [Admin API](/docs/admin.html)). Devii reaches it through the normal `site_analytics` catalog tool, so the platform enforces admin access; the agent never queries the database directly for it. ## Web fetch `fetch_url` sends realistic browser headers, reduces pages to text, caps size, and refuses private, loopback, and link-local addresses (an SSRF guard) unless explicitly allowed. This limits the blast radius of a prompt-injected page. `http_request` (arbitrary external API calls) and `attach_url` (storing a remote file as an attachment) share the same SSRF guard and size cap, so neither can be turned into a request forger against internal addresses. `attach_url` runs the downloaded bytes through the normal upload validation (allowed types, size limit) before storing them. ## Confidentiality The system prompt instructs Devii never to disclose the underlying AI model, provider, inference endpoint, or any backend URL or infrastructure detail, even when such values appear inside a tool result, and to omit the model name when reporting cost. ## Audit trail Every turn is recorded in `devii_turns` (owner, username, timestamps, truncated prompt and reply, iterations, tool-call count, cost, and any error), giving administrators a complete account-scoped history of what Devii did. ## Account scope A signed-in user's Devii operates that user's **own** account via the platform API with their API key, so it has exactly the permissions that user has (admins included). It cannot exceed the account's own authority; the platform enforces every action.