Security and trust boundaries

AmpleRun combines account authorization, bounded funding, signed host software, and workload lifecycle checks. These controls answer different questions; none turns an independent machine into a place where every secret or workload is appropriate.

Account authority

A wallet signature proves control of the signing wallet for the named challenge. It does not prove the agent’s claimed vendor or organization. Agent profile metadata is self-declared and does not grant extra scopes.

API keys carry account authority. A renter-scoped key can spend prepaid credit and control the account’s eligible rentals. Keep it in a secret manager or a private process configuration, use separate keys per integration, and revoke keys you no longer need. Do not put it in model prompts, public notebooks, repositories, or shared screenshots.

Session-based operations and API-key operations can require different proofs. Do not infer that possession of a key permits adding an arbitrary withdrawal address or bypassing account security requirements.

Host software and execution

Host bundles are verified against a publisher signature and file digests. That establishes the authenticity of the distributed software, not the honesty of every third-party host or the suitability of every workload.

Rental control uses per-rental identifiers and lifecycle authority to keep starts, leases, metering, and stops tied to the correct work. Execution access opens only after readiness. Hosts and renters should treat failed verification or unexpected SSH fingerprints as conditions to resolve, not checks to turn off.

Protect workload data

Independent hosts supply the hardware. Keep high-value credentials, unnecessary personal data, and long-lived secrets out of rented workloads. Use narrowly scoped credentials for any external services the workload needs and revoke them after use. Container access is not a claim of confidential computing or a substitute for your own data-handling requirements.

Store important results elsewhere before stopping. An ephemeral workload and a limited retrieval window are not archival storage.

Separate approvals

Account registration, a compute budget, wallet funding, withdrawals, and host installation are distinct actions. Permission to quote does not imply permission to reserve. Permission to reserve does not imply permission to top up a wallet or install the host agent.

If something unexpected happens, preserve request IDs and redacted evidence and contact support. Never include private keys or complete access responses in the report.