Security

Authority is enforced structurally, not by trusting the caller.

Every claim on this page is stated alongside the mechanism that produces it. Where a property depends on how you configure the runtime, that is said plainly.

Trust boundary: Roblox server
Client authority: None
External provider: Advisory only
Product stage: Generally available

Properties

Claim, then mechanism.

A guarantee with no mechanism behind it is marketing. Each pairing below is a design decision you can check against the documentation.

Server authority No client can cause a world-state commit by sending a message.: Planning, validation, resource settlement and commit all execute server-side. Client input enters as a goal request that passes through the same validation as everything else, and carries no capability of its own.
Capability boundaries An actor cannot attempt anything its role did not declare.: The planner composes plans exclusively from the action surface declared by the adapter and granted by the role manifest. There is no dynamic dispatch into arbitrary code at decision time, so an undeclared action has no reachable call path.
Deterministic commits The same observation, manifest and goal produce the same plan.: The local planner is deterministic and seeded. External evaluation is the only source of non-determinism, it is opt-in, and disabling it restores reproducibility exactly.
Atomic resource movement A plan that cannot pay for itself never partially executes.: Currency, stock, fuel, cargo and charges move inside one transaction that is applied whole or discarded. Intermediate state is never observable to players or to other actors.
Observation is an allowlist Data the agent was not given cannot leak from the agent.: Adapters declare the fields they normalise. Anything undeclared is absent from the planner input, absent from diagnostics, and absent from any external payload — not filtered later, but never collected.
External-provider isolation An external model can propose. It cannot act.: Providers receive a redacted subset of the observation, explicitly enumerated per configuration. Their response re-enters as a proposal at the validation step and is checked identically to a local plan. They hold no capability, no resource authority and no commit path.
Safe failure Degradation stops the actor; it does not loosen the rules.: A provider timeout falls back to the deterministic planner. A manifest that fails to load prevents attachment rather than defaulting to a permissive role. A stalled planner holds the last safe state and stops issuing actions.
Player data is not collected by default The runtime does not gather account identifiers on your behalf.: Nothing about a player enters an observation unless an adapter explicitly declares it. If you choose to declare player-derived fields, you remain the controller of that data and are responsible for the disclosures your experience makes.

Capability boundaries

Who can do what.

The same matrix that appears on the product page, because it is the shortest accurate summary of the trust model.

What each participant is permitted to do in the execution path
Capability	Client	Server runtime	External model
Read world state	Replicated view only	Full authoritative state	Redacted observation, if enabled
Submit a goal	As a request, subject to validation	Directly	As a proposal
Select the next action	Never	Planner output	May rank or suggest
Skip authority validation	Never	Validation is not optional	Never
Move resources	Never	Atomic transaction	Never
Commit world state	Never	Sole writer	Never

Failure behaviour

Degradation stops the actor. It never loosens the rules.

Every failure path below was chosen so that the safe outcome is also the default outcome.

Failure conditions and the resulting behaviour
Condition	Behaviour
The external provider times out or is unreachable	The deterministic local planner continues. The actor keeps operating.
A role manifest fails to load or fails validation	Attachment is refused. The actor does not run with a partial or default role.
A proposed action fails authority validation	A typed rejection is returned and the actor re-plans without that action.
A resource transaction cannot be satisfied	The whole plan is discarded before actuation. Nothing partially applies.
The planner cannot produce a valid plan	The actor holds its last safe state and stops issuing actions.
An adapter throws during actuation	The action is marked failed, the transaction is rolled back, and the fault is recorded in diagnostics.

Privacy posture

Data minimisation by construction, not by policy.

An allowlist that decides what is collected in the first place is a stronger control than a filter applied afterwards.

What the runtime collects about players: Nothing, unless an adapter explicitly declares a player-derived observation field. There is no implicit collection of account identifiers, join data or chat.
What leaves the Roblox server: Only the observation fields enumerated in your external-evaluation configuration, and only when that feature is enabled. With it disabled, nothing leaves.
What diagnostics expose: The active goal, the plan, verdicts with their evidence, and resource spend — all filtered through the same declared allowlist as observation.
Who the controller is: You are. If you declare player-derived fields, you remain responsible for the disclosures your experience makes and for any consent it needs.

Security documentation Privacy notice

Capability

Client

Server runtime

External model

Read world state

Replicated view only

Full authoritative state

Redacted observation, if enabled

Submit a goal

As a request, subject to validation

Directly

As a proposal

Select the next action

Never

Planner output

May rank or suggest

Skip authority validation

Never

Validation is not optional

Never

Move resources

Never

Atomic transaction

Never

Commit world state

Never

Sole writer

Never

Condition

Behaviour

The external provider times out or is unreachable

The deterministic local planner continues. The actor keeps operating.

A role manifest fails to load or fails validation

Attachment is refused. The actor does not run with a partial or default role.

A proposed action fails authority validation

A typed rejection is returned and the actor re-plans without that action.

A resource transaction cannot be satisfied

The whole plan is discarded before actuation. Nothing partially applies.

The planner cannot produce a valid plan

The actor holds its last safe state and stops issuing actions.

An adapter throws during actuation

The action is marked failed, the transaction is rolled back, and the fault is recorded in diagnostics.

Authority is enforced structurally, not by trusting the caller.

Server authority

Capability boundaries

Deterministic commits

Atomic resource movement

Observation is an allowlist

External-provider isolation

Safe failure

Player data is not collected by default

Authority is enforced structurally, not by trusting the caller.

Server authority

Capability boundaries

Deterministic commits

Atomic resource movement

Observation is an allowlist

External-provider isolation

Safe failure

Player data is not collected by default