Safety model

The API is a client of the olix core, not a back door around it. These rules are enforced by the gateway and each one has an automated test that drives a real test-mode core.

Local only

The gateway binds loopback and refuses to start on any other address. It rejects requests whose Host header is not a loopback name (a web page cannot rebind a hostname to it), requests from a non-loopback client address, and any request carrying an Origin header. CORS is closed; there are no cross-origin headers.
No tunnel, no relay, no telemetry. The API cannot trigger olix's one gate for sending a question off the machine.
It is off until the owner runs olxcore api on, and olxcore api off stops it.

The owner approves actions

Turns started over the API run with the permission mode ask, whatever the owner uses day to day. Anything that changes a file or the system becomes an approval card.
The card reaches your client as a read-only question event. It goes to the owner's olix app, which is the only place to approve it. Your client may deny it (POST /v1/turns/{id}/answer with "decision": "deny") or wait. An approve, a free-text yes or a scope grant is refused with 403 approval_not_allowed, and never reaches the core. The same rule holds on the socket.
A card nobody decides is denied after five minutes.
Credentials are never typed by olix on anyone's behalf over this API.

Real session: an approve attempt, then a deny

$ curl -s http://127.0.0.1:8780/v1/turns/t_914c50b4669d9e67/answer ... -d '{"question_id": "qmw507q6r0", "decision": "approve"}'
{"error":{"message":"an API client may only deny an approval; the owner approves in the olix app","type":"invalid_request_error","code":"approval_not_allowed","param":null}}
$ curl -s http://127.0.0.1:8780/v1/turns/t_914c50b4669d9e67/answer ... -d '{"question_id": "qmw507q6r0", "decision": "deny"}'
{"answered":true,"decision":"deny","question_id":"qmw507q6r0"}
notes.txt exists: no
{"type":"question","tool":"bash","risk":"mutate","question":"Allow bash?\nRunning printf hello >\n{\n  \"command\": \"printf hello > \\\"/tmp/olix-demo/project/notes.txt\\\"\"\n}"}

The first answer is refused. The second is accepted. The file the turn wanted to write does not exist, and the card is shown to the client as information only.

No vault, no memory, no other apps' sessions

Nothing under ~/.olx (the vault, memory, settings) can be granted as a folder or named in a request, and history endpoints skip sessions whose folder is inside it. There is no endpoint for memory or settings values (only the settings field list).
A token reaches only its own app's sessions. Another app's session id is a 404. The owner's other sessions need the separate history.read scope, granted per token.

No focus stealing

Nothing in the API activates an app, opens a window or switches a Space. Turns run in the core's background loop.

No fabrication

Endpoints return exactly what the core emitted. If the core is not running you get 503 core_unavailable; if it disappears mid-turn you get an error event, not a made-up completion.

Honest limits

A turn is answered by olix, which may use what it knows about the owner when relevant. The API does not expose memory contents through any endpoint, but an app that asks olix a personal question may get a personal answer. Grant only to apps you trust, as with any assistant.
A turn can read files in the folder you were granted.
Custom tools (your own tools the loop can call) are Coming.