Agent God Mode
Security and Privacy

Your Code, Infrastructure, and Subscriptions Stay Under Your Control.

Agent God Mode connects only to the GitHub repositories and Agent Instances you authorize. Each Agent Instance runs Paseo on your infrastructure. Agent God Mode does not ingest, store, index, or analyze repository source; coding-agent CLIs perform that work on your own machine or company infrastructure.

Clear Boundaries

See the Work Without Exposing the Keys.

Visible in Agent God Mode

Workstream Activity

  • Workstreams and branches
  • Plans and annotations
  • Timelines and questions
  • Review findings and status
Protected AccessSigned-in accounts and encrypted connections
Kept Private

Credentials

  • GitHub authorization
  • Paseo pairing details
  • Provider sign-in sessions
  • Private network access

Private Accounts

Each signed-in account can access only its own workstreams, plans, Agent Instances, and settings.

Protected Credentials

GitHub and Paseo connection details are encrypted and are not displayed after setup.

End-to-End Encrypted Relay

Paseo Relay connects to a paired Agent Instance without exposing that instance to the public internet.

Optional Tailscale Connection

Use your private tailnet for direct browser-to-instance access.

GitHub Metadata, Not Code Ingestion

The GitHub connection lists authorized repositories and coordinates branches, pull requests, and checks. Agent God Mode does not ingest, store, index, or analyze repository source through that connection.

Isolated Execution

Paseo checks out the selected branch into an isolated workspace on your infrastructure. That is where agents read and change code.

Credentialless AWS Access

Connected AWS accounts use short-lived OIDC and STS sessions. Each connection receives a unique external ID and restricted IAM role so it cannot be used for another account.

Auditable Infrastructure Actions

CloudFormation and Session Manager actions appear in your AWS CloudTrail history. Disconnecting removes app access; deleting the access stack in AWS removes its IAM roles completely.

Protected While Agents Work

Your Agents Can Keep Working Without an Open Tab.

Agent God Mode records progress and reconnects to your Agent Instance as work advances.

Connect Your Existing Infrastructure.

Keep the Code Private and the Work Visible.

Sign In to Get StartedOpen Agent God Mode