ADIL ECO · TOOLS, SECURITY AND PRIVACY
The model proposes. Your application decides.
How agent and tool-confirmation behaviour works in the Eco candidate, and where its protection ends. Neither the Eco V1.1 A3b model nor the SDK is publicly released: there is no download, package or installer, and nothing on this page announces one.
The model only proposes
With the engine, Eco never runs a tool by itself. It proposes a call; the engine validates the arguments against the tool's schema; your application's code then runs, or does not run, the tool. Every state-changing tool waits for an explicit approval of the exact proposal, and each proposal can be resolved only once.
The SDK never approves anything on your behalf. An example host that has no terminal denies by default.
When confirmation is required
| Situation | Behaviour |
|---|---|
| State-changing tool | Always a proposal; runs only after your application approves it. |
| Read-only tool, arguments the user wrote | May run directly. A value counts as written by the user only when its whole words appear contiguously in one user message, or it is an enum value of the schema. |
| Read-only tool, arguments the user did not write | Becomes a proposal for confirmation by default. |
| Tool that reads private data or sends anything outside your process | Register it with confirmation required: then every call is a proposal, even when every argument is grounded. Read-only means the tool changes nothing, not that it is harmless. |
| Call built from a tool result | Denied by the SDK by default when its arguments were never written by the user. It can be returned to a person for review instead. |
Do not turn off the argument checks for any tool that could expose or send data. Grounding is a text check that a value appeared in a user message. It is not consent, not user intent and not data-loss prevention, and it does not catch injected requests whose values all appear in the user's own message.
What this does not protect against
- Untrusted text in tool results can influence the model. Show the model's text and your tool data separately, and treat strings from tools as quoted data, never as instructions.
- Cancellation is cooperative: once a tool has started, its side effect is not undone. Make tools idempotent and check for cancellation before each side effect.
- The Node.js host process is not a sandbox. It runs with your user's file and network permissions: load only trusted binaries and the pinned model from directories your application owns.
- The current candidate is ad-hoc signed and not notarised. Independent security acceptance for a public release has not been given.
Privacy boundary
Prompts and outputs stay on the local machine unless a tool or service that you add sends them elsewhere. The SDKs collect no telemetry. The local service listens on the loopback address only and rejects requests from browser pages unless an origin is explicitly allowed.
This describes the software. It is not a statement about adiledge.com, which has its own privacy notice.
Tool integration guideAgent execution overviewPrivacy notice