Powerful enough to act.
Bounded enough to trust.

Jobs: Claude Code and Codex

Jobs run through the Claude Code or Codex you installed and signed in to yourself. They can read files, edit code and run commands without asking before each step. Your provider's terms, availability and usage limits apply.

• Allow once. Jobs are off until you allow them. KEORIS asks once, before the first job runs. While Parental controls are locked, jobs cannot be allowed or started, and a running job is stopped.
• Where a job works. A job starts in the project folder you name, or in Documents\KEORIS Jobs if you name none.
• Codex jobs run in Codex's own sandbox: they change files only in their folder, their commands have no internet, and they cannot ask to leave that boundary. They start without your personal Codex settings, rules or apps. Web search runs only when you ask for “Codex, with web”. Codex can still read files outside its folder, and what it reads goes to OpenAI. Codex may remember a job's folder as trusted in your own Codex settings. A Codex job won't run in a folder that has its own Codex settings.
• Claude Code jobs start in their folder with your own Claude Code settings. The .claude settings inside the folder you pick are ignored, so a hook in a downloaded project cannot run. KEORIS blocks Claude Code's file-editing tools on KEORIS's own files, Windows Startup, and your Claude Code and Codex settings. It cannot fence what a command does: a Claude Code job can read, change and run anything your Windows account can, including other folders and the internet.
• Connected apps are off. Every Claude Code job runs with no connected apps at all: no MCP connectors, claude.ai connectors or plugin connectors. Codex jobs start without your Codex apps and servers too. Built-in tools and commands still work.
• Codex versions. KEORIS runs Codex jobs and bots only on the Codex app versions it has tested. The Codex app updates itself often, and a newer version gets a plain refusal until KEORIS tests it. A Codex installed with npm or found on PATH is always refused. Claude Code keeps working, so plan on Claude Code for jobs at launch.
• Stop. Stop ends the job's own programs. It does not undo changes the job already made, and it does not cancel anything the job set up to run later, such as a Windows scheduled task. A spoken job also gets 10 seconds to cancel before it starts.

KEORIS cannot guarantee that a Claude Code job will not change files outside its folder or run other commands. Allow jobs only if you're comfortable with that. Keep backups, check a job's work before you rely on it, and only start a job you are willing to have done. Claude Code and Codex send what they read to their providers.

Local assistant: files and destructive actions

• Search and document tools enforce approved-folder boundaries outside the interface.
• Moves, renames, and deletions require confirmation.
• Deletes use the Windows Recycle Bin. KEORIS refuses deletion when a network drive, oversized file, or unavailable Recycle Bin could cause permanent erasure.
• Backups exclude stored secrets.

These assistant controls do not cover jobs. A job's commands follow the coding tool's own rules and the limits above.

Local assistant: screen vision and screen driving

• Screen vision always displays a visible indicator while an image is being read. The picture goes to Anthropic or OpenAI through the API key you saved.
• Walkthroughs (“help me install the thing I downloaded”) run only an installer KEORIS found in your Downloads folder, and only after you say yes on its RUN INSTALLER card, by click or by voice. Windows' own permission prompt and the installer's buttons stay yours to click. A step check may send a picture of your screen, as screen vision does, but not while KEORIS sees a banking or password window open. Planning the steps sends the program’s name and your recent conversation to your connected cloud brain, even if you chose the local model.
• Screen Driving is beta, off by default, and currently limited to File Explorer and Notepad.
• You see and approve a plan first. Save, send, delete, download, and overwrite steps pause again.
• Financial windows, sign-in surfaces, password fields, administrator windows, and UAC prompts are blocked.
• Screen driving cannot run unattended, from a schedule, or from the phone companion.

These limits describe KEORIS's built-in Screen Driving feature. A Claude Code computer-use or browser tool in a job follows that tool's own controls; it is not the same feature.

Local assistant: browser isolation

Pages in KEORIS's built-in assistant browser run in isolated sessions without access to KEORIS files, settings, keys, or internal controls. Camera, microphone, and location requests are denied by default. Downloads are disabled in that browser stage, and local-file URLs are refused. This does not describe a coding agent's separate browser tools or the separate KEORIS Desktop app.

Cameras and remote access

• Local RTSP camera helpers bind to the loopback address rather than the open network.
• Blink live-view sessions use short-lived, unguessable local tokens and are released when viewing stops.
• Cloud camera traffic uses the camera provider because that is how Ring, Blink, and Nest operate.
• The mobile companion binds to Tailscale and refuses to fall back to an exposed local-network server.

Known limitations

When the installer is released it may not be code-signed yet, so Windows SmartScreen can warn before it runs. Get it only from the download link on keoris.dev. Keys and secrets KEORIS saves itself use Windows secure storage. The separate Codex sign-in for bots is a plain file Codex keeps in KEORIS's data folder, and other local records are not all encrypted. Claude Code and Codex jobs necessarily send the context they use to their providers.

These controls reduce what a job can do; they do not guarantee that generated code or commands are correct. Review a job's changes before you rely on them. This page describes KEORIS 0.21.0, checked on 30 October 2026. It is not an independent security audit.

See the full Privacy page for network destinations and local storage, and the licence for the terms of use.