◆ Sparround

Project 3: a locked-down messaging bot

Goal: a bot you can use from your phone that nobody else can use — and that is restricted so it cannot do damage.

This project brings every layer of the Security stage together in one configuration: access control, tool narrowing, isolation and approval policy.

Four decisions, in this order:

  • Who? — TELEGRAM_ALLOWED_USERS with your ID only; never GATEWAY_ALLOW_ALL_USERS
  • With what? — only the toolsets you need on that platform via hermes tools; do you actually need the terminal?
  • Where? — terminal.backend: docker with resource limits
  • Approved how? — on a messaging platform approval arrives as a message; write your red lines into approvals.deny

Then test it: ask a friend to message the bot — they should get nothing.

One subtlety: the bot processes text from your phone, and that text may contain content you pasted from elsewhere (an email, a ticket, a snippet from a website). So the bot channel is also an entry point for untrusted content. Keeping the bot's toolset narrower than the CLI's is therefore not an arbitrary restriction — it is an architectural decision.

Practice. After setting the bot up, run three tests: (1) an unauthorised user gets no reply, (2) a disabled toolset does not work, (3) a command in approvals.deny does not execute. Done means: you have written down the result of all three — that is the evidence you show your team.

📚 Sources and documentation