Four layers of isolation
- Vault tiers: clients/ in its own vault with custom hooks
- Hook denies: block agent from feeding clients/ content to web_fetch / browser
- Provider tiers: sensitive vault uses local LLM; general vault uses cloud
- Audit log: PostToolUse pipes every tool call to syslog
A common hook snippet
{
"PreToolUse": {
"web_fetch": ".kition/scripts/deny-if-client-path.sh",
"browser_open": ".kition/scripts/deny-if-client-path.sh"
}
}