# ADR 0002: Single-user security model

## Status

Accepted

## Decision

Aidoit is single-user software, but no sensitive endpoint is anonymously
accessible in production.

Initial access:

- Tailscale for private network access
- bearer token for development
- later PocketID or Authentik for browser login
- separate execution permissions for every AI team
- immutable audit records for tool calls and infrastructure changes