Anyone can promise their AI is careful. A cloudlet doesn't have to: injected, hallucinated, and over-reaching instructions all hit the same wall — an evaluator that refuses to run anything outside the capabilities you granted, on every dispatch, every time.
Every stack that lets a model act on real systems inherits the same three failure classes. The difference between platforms is not whether these happen — it's what stands between them and your data when they do.
An agent reads a poisoned document, email, or web page, and comes back carrying instructions nobody on your team wrote. On most stacks, whether those instructions run is decided by how persuasive they were — the defense is the prompt, and prompts lose arguments.
A confidently invented call that happens to mutate data isn't a quality bug — it's an incident. Stacks that check generated code after it runs, or trust a human to spot the flaw in review, discover the destructive ones the expensive way.
Free-form generated code executes with everything the host process can reach — filesystem, network, every credential in the environment. One over-scoped agent turns a single bad generation into a server-wide event.
Every executable step on a cloudlet must name a capability the runtime has registered. There is no open import surface to wander through, no dynamic escape hatch into code the platform has never seen. Whether an operation exists is a lookup with exactly two answers — and a step naming something unregistered is refused outright.
In a general-purpose language that question has no practical answer: any identifier might resolve somewhere, so a fabricated call surfaces in the build if you're lucky and in production if you're not. Here, the fabrication has nowhere to land.
Before generated logic reaches you — or an agent — every node of its execution tree is checked against the very registry the runtime executes from: not a maintained copy that can drift out of date, the live source of truth itself. The check descends into everything, including bodies nested inside loops, branches, and callbacks.
A tree referencing anything unknown is discarded and regenerated. What you receive is either fully resolved or an explicit error — there is no third state where plausible-looking output with a buried fault lands in your lap.
When a cloudlet executes logic it has reason to distrust — model output, user-supplied automation — that logic runs inside an explicitly declared set of capabilities, checked by the evaluator at every single dispatch. Not by a linter beside the code. Not by a review step. By the thing doing the executing, at the moment of execution.
And a grant can be bound to one specific argument. Not permission to read files — permission to read one named file. Not database access — one named connection. A perfectly well-formed operation aimed at anything else fails exactly as if the operation never existed. That turns prompt injection from a containment problem into a non-event: the attacker isn't debating your system prompt, they're arguing with a grant list that doesn't negotiate.
On most stacks, role checks are a middleware pattern the next generation of code might implement differently, or forget. On a cloudlet, roles are objects of the runtime itself: the role inside a caller's token is the same role every generated endpoint is gated on and the same role you administer people with — evaluated at the execution layer, on every call.
Service tokens are scoped to exactly the roles you choose and expire on a date you set. The administrative surface is reserved for developer users. There is no second, parallel access model for generated code to get wrong, because generated code doesn't implement access control — the runtime imposes it.
Logic executes inside a restricted managed runtime, and restrictions apply at the granularity of individual functions — not as one process-wide setting you hope covers every case.
Generated write endpoints can journal every change they make, and the backend keeps a filterable, severity-tagged log — so "what happened at 03:14" is a query, not an archaeology project.
Runs on your cloud, on-prem, or fully air-gapped — and the runtime is MIT-licensed open source, so every claim on this page can be checked against the code rather than taken on faith.
The honest question for any AI-backend stack: stopped by what, and how late? Cyan is enforcement by the platform itself, amber is enforcement you configure and maintain by hand, grey means the stopping is up to you.
| Platform | The boundary lives in | One bad generation reaches | RBAC enforced by | Stopped before execution? |
|---|---|---|---|---|
| Magic Cloudlet | The evaluator — checked at every dispatch | Nothing outside its capability grant | The runtime itself, per function, per role | Yes — structurally, on every layer above |
| Vibe-coded backends | The prompt, then whoever reviews the output | Whatever the generated server can touch | Middleware the next generation can rewrite | No — review happens after the code exists |
| Supabase | Row-level security policies, written by hand | Everything a mis-scoped policy exposes | The database — when policies are right | Not for the backend logic you generate on top |
| Hasura | A hand-authored permissions configuration | Everything the configuration allows | The API gateway layer | No — business logic runs elsewhere, unchecked |
| LangChain | Your own application code | Whatever the host process can reach | Wherever you build it — if you build it | No — the framework executes what you hand it |
| n8n | Node configuration — code nodes run free-form JS | The host, from any code node | Instance-level access control | No — a code node is an open door by design |
A security page you can trust has to draw its own perimeter. Here is ours.
An instruction that is authorized, well-formed, and commercially wrong will still run — the runtime enforces capability, not judgment. The databases you connect keep their own security posture; a weak SQL Server password is weak on any platform. And administrator credentials remain phishable, which is exactly why the admin surface is limited to developer users and service tokens carry expiry dates. We'd rather scope the guarantee precisely than sell you a force field.
Everything above is enforced at the moment of dispatch, by the evaluator, on every call — not promised by configuration sitting next to code that's free to ignore it. Competitors can add review steps, policies, and guardrail prompts. What they can't retrofit is a runtime where an unauthorized operation has no way to be expressed. That difference is architectural — and architecture doesn't have off days.
20 minutes. Walk us through your worst case — injection, a rogue agent, an over-scoped automation — and we'll show you, mechanism by mechanism, where it dies inside a cloudlet.