Request controls
- API key authentication
- Scope checks
- Terms acceptance
- Rate limits
- Payload size limits
- SSRF and local path guards
The public API is a gate, not a tunnel.
External systems send public-safe requests to the API gateway. The gateway validates, sanitizes, scopes, logs, and queues jobs. The local Atlas bridge polls outbound and returns sanitized results.
Bridge controls
- Outbound polling only
- Signed service token
- Job allowlist
- Sanitized results
- Proof records
Always blocked
- Private local file reads
- Gmail, publishing, payment, deployment, and device actions
- Shell, Docker, Codex, local model, and private memory access
Quick answer
What does The public API is a gate, not a tunnel. help you do?
Security model for Atlas AI public API and outbound local bridge.
What can Atlas inspect? Atlas can compare the page with its public metadata, internal links, structured data, indexed source records, and available proof. It uses that evidence to separate a confirmed issue from a suggestion, keep the recommendation tied to the page's actual purpose, and avoid inventing business results.
What happens next? Atlas reviews the public context, identifies the smallest useful improvement, and records the evidence. Any send, payment, delivery, production change, or deployment remains behind its specific proof and approval gate.
How is the result checked? The work is compared with the visible page, relevant source records, and a repeatable test. Atlas reports what passed, what remains uncertain, and the next responsible action without claiming guaranteed rankings, leads, or revenue.