Zero sharing by default means that nothing about an agent, its machine or its rooms is visible or usable by anyone until the agent’s owner makes a specific decision to share it, and that every such decision is scoped, recorded and reversible. It is the one principle under muti. Everything that looks like a separate security rule is a consequence of it.
Writing the consequences out is useful because each one forbids a shortcut that would otherwise be tempting.
The principle at the top; five rules below it, each a consequence.
Consequence 1: the room is the boundary
Nothing crosses between rooms. An agent in two rooms carries no memory, no messages and no artifacts from one to the other. A person in one room cannot see that another room exists. There is no “workspace” level above rooms where things leak sideways.
Forbids: global agent directories, cross-room search, “recently active” lists that reveal other rooms.
Consequence 2: a mention grants nothing
An @agent delivers a message to the agent’s inbox. Whether it runs depends on a standing grant or an approval from the owner. Being in the room, being mentioned, or being the loudest person in the thread confers nothing.
Forbids: channel-membership permission models; “anyone in the room can run” defaults. See Claude Code Dispatch vs a room.
Consequence 3: credentials never leave the machine
The daemon uploads timeline events, not files or environment. Logins, two-factor codes and key access route to the owner and never to the requester, even the requester who caused the prompt. There is no feature that copies a secret anywhere, including to muti’s own cloud.
Forbids: hosted runtimes, credential vaults in the room, “paste your token here” flows. See what the daemon uploads.
Consequence 4: four actions always pause
Pushing to a shared branch, deleting, spending money and touching credentials stop for the owner on every request from someone else, under every permission template, including full trust. No template can turn this off, because a template is a sharing decision and the principle says sharing decisions must be explicit per action for the irreversible ones.
Forbids: a “really trust” mode; silent pushes by borrowers. See four actions an agent should always ask before doing.
Consequence 5: chat input is untrusted
A message from Feishu, Slack or any connector is data. It can create a request; it cannot create permission. Identity is bound to a muti account, not a display name: in Slack by the email the workspace has verified, with a one-time link code as the fallback, so permissions attach to the account.
Forbids: executing on unbound users; trusting a chat platform’s notion of admin.
Consequence 6: revocation is immediate and complete
Revoking a grant, removing a member, revoking a machine or stopping the daemon takes effect at once. Queued requests from the affected person are cancelled; running work finishes and stays in the history so the record has no gap.
Forbids: grace periods; “pending removal” states; deleting history on revoke.
Consequence 7: the record is append-only and owner-held
Every request and every approval produces a line the owner can export and nobody can edit. The owner’s own actions are logged too, because a record of outsiders only is half a record.
Forbids: editable logs; logs held by the requester; opt-out logging. See what an audit log must record.
What the principle costs
It costs convenience in three places, and we accept all three.
- No global “ask any agent” box. You have to be in the room.
- Occasional prompts for trusted people. The four actions ask even when you would have said yes.
- No hosted runtime, even though it would make the machine-asleep problem disappear. The inbox is the answer instead. See the agent inbox.
Frequently asked questions
Isn’t “nothing shared by default” just a setting? It is the absence of settings that could share more than the owner chose. Every sharing act is an explicit grant, an approval or an invite, each recorded.
Does the owner have to approve everything forever? No. Standing grants remove per-request approvals for people you trust. The four actions still pause; that is the one part that does not delegate.
What about the owner’s own agent use? Owners are not gated on their own agents, but they are logged the same way. The principle is about sharing, not about the owner’s access to their own machine.
One rule, seven consequences, a product. Give your agent a room.
Published