Plow Latch - Local AI Desktop Manager

Product Introduction

1. Definition: Plow Latch is a local AI desktop manager and agent access control layer for macOS. Technically, it operates as a system-level permission broker that sits between AI agents—such as OpenAI Codex, Anthropic Claude Code, OpenClaw, and Hermes—and the macOS file system, browser, and command-line interface (CLI). It functions as a privilege management daemon that intercepts every system call, file access request, and browser navigation initiated by an AI agent, then evaluates each request against a user-defined policy before granting or denying access. Unlike cloud-based AI security solutions, Plow Latch performs all policy evaluation, logging, and permission brokering entirely on the local machine, ensuring sensitive data never leaves the user's hardware.

2. Core Value Proposition: Plow Latch exists to solve the fundamental security paradox of autonomous AI: enabling LLM-based agents to perform real, complex work on a desktop operating system without granting them unrestricted, unfettered access to sensitive data and system resources. Its primary value proposition is safe, granular AI control of macOS through a "job-scoped access" model—a paradigm where the user defines a specific task (e.g., "book a campsite at Yosemite for June 15"), and the agent is automatically restricted to only the folders, websites, and commands required to complete that task. This eliminates the need for insecure "blanket" permissions (such as granting Full Disk Access or root privileges) and renders the agent effectively incapable of performing unauthorized actions, even if compromised or subjected to malicious prompt injection attacks. Plow Latch transforms a general-purpose AI coding agent into a constrained, job-specific automation tool suitable for high-stakes, personal-data-sensitive tasks.

Main Features

1. Job-Scoped Policy Enforcement Engine: At the core of Plow Latch is a semantic access control engine that translates a user's high-level natural language job description into an enforceable, low-level permission policy. When the user writes a job instruction (e.g., "Reconcile invoices in the Downloads/Q3 folder and email a summary to [email protected]"), Latch parses this intent and generates an internal whitelist. Every subsequent request from the AI agent—whether it is a stat() system call, a GET request to a URL, or a popen() command—is matched against this whitelist in real-time. Requests that fall within the job's scope are automatically approved; out-of-scope requests are blocked or flagged for user review. Critically, the job instruction text cannot be read or modified by the agent, because it resides in a memory-mapped space external to the agent's context window, making it cryptographically impossible for the agent to rewrite its own constraints through prompt manipulation.

2. AI Gatekeeper with Multi-Tier Approval Workflow: Plow Latch implements a risk-tiered approval system that balances autonomy with security. The Gatekeeper component evaluates each incoming request and classifies it into one of three risk categories: routine (e.g., reading a text file in the approved folder), moderate (e.g., executing a shell command or submitting a form), and critical (e.g., modifying/deleting files, sending emails, reading password manager entries). Routine requests are auto-approved using a statistical decision engine trained on normal operation patterns. Moderate requests trigger a lightweight interactive prompt in the Latch menu bar. Critical requests require explicit user authorization, which can be authenticated via Touch ID or system password. This layered approach ensures high throughput for common operations while maintaining a strict human-in-the-loop for any action with irreversible consequences.

3. Password Vault Integration with Blind Delivery: Plow Latch features a secret redaction and injection system that integrates with the macOS Keychain. When an agent needs to authenticate to a service (e.g., logging into a travel portal to book a campsite), Latch retrieves the relevant credentials from the Keychain and injects them directly into the browser form or CLI process without exposing the plaintext value in the agent's tool-call output. The agent sees only a confirmation token (e.g., [REDACTED_LOGIN_SUCCESS]) rather than the actual password or cookie. This prevents credential exfiltration even if the agent is malicious or compromised, because the secret never enters the model's context window.

4. Prompt-Injection Hardening and Request Auditing: Plow Latch includes a context-integrity verification layer that detects and mitigates indirect prompt injection attacks. It continuously monitors the content the agent is processing (web pages, emails, documents) for instruction-like patterns; when a web page directs the agent to "ignore your instructions" or "execute this script," Latch flags the interaction as a potential injection attempt and blocks the subsequent high-risk requests. Additionally, Latch maintains a detailed, append-only audit log of every request: the exact tool-call payload, the agent's reason (if provided), the request's classification (allowed/blocked/deferred), and a timestamp. This log is stored in SQLite on the local disk and is exportable, providing complete traceability for compliance and debugging purposes. All logging is structured around the OCSF (Open Cybersecurity Schema Framework) event format, facilitating integration with SIEM tools.

5. Cross-Agent Compatibility Framework: Plow Latch is agent-agnostic and implements a session-based integration layer that supports multiple leading agent frameworks concurrently. It exposes a local HTTP/WebSocket API that wraps the macOS Inter-Process Communication (IPC) channels, allowing Claude Code, OpenAI Codex, OpenClaw (formerly Clawdbot/Moltbot), Hermes, and other MCP (Model Context Protocol) based agents to register sessions with Latch. Each session is bound to a specific job policy, so a user can run a document-processing agent and a web-research agent simultaneously, each completely sandboxed to its respective permissions. The system supports role-based session tokens, preventing one agent from invoking another agent's privileges.

Problems Solved

1. Pain Point: The "Blanket Permission" Vulnerability: Traditional approaches to giving AI agents macOS control involve granting the agent full disk access, root privileges, or "Accessibility" permissions. This creates a catastrophic security hole: a single successful prompt injection (e.g., a malicious web page telling the agent to delete files) can trigger mass data exfiltration or system destruction. Plow Latch solves this by implementing principle of least privilege at the system-call level, ensuring a malicious or manipulated agent can only touch the specific three folders and two domains it was assigned. It also solves the "invisible autonomy" problem—users previously could not know what an agent was doing on their machine; Latch provides real-time visibility and complete logs of every action.

2. Target Audience: The product is designed for three distinct personas. (a) Professional Developers and MLOps Engineers: Individuals who use Claude Code or Codex for autonomous coding but are unwilling to connect these tools to production repositories, cloud credentials, or databases without a control plane; they need a local policy engine that doesn't add cloud latency. (b) Technical Solopreneurs and Power Users: Operators who use OpenClaw or similar frameworks to automate personal workflows (email sorting, expense reconciliation, travel booking) and require zero trust security for sensitive personal data like bank accounts, social security numbers, and medical records. (c) Compliance-Conscious Startup Teams: Small teams that want to leverage AI automation for business operations (CRM updates, invoice processing) but need SOC 2-aligned audit trails of all AI system actions with clear separation of duties (human approval for critical ops).

3. Use Cases: Plow Latch is essential for any scenario requiring trusted AI autonomy. Concrete examples include: (1) Autonomous Travel Booking: An agent searches for available campsites at a national park with specific amenities, navigates the reservation system, enters personal information, and pays via stored payment method—all while Latch ensures the agent never accesses unrelated browser history or local financial files. (2) Expense Report Reconciliation: A user connects OpenClaw to Gmail and local Downloads folders; the agent is scoped to match 500 e-receipts to bank transactions and generate a PDF report—a task impossible to monitor manually, but previously too risky to delegate. (3) CI/CD Maintenance: A developer scopes a Codex session to the ~/repos/api-gateway directory and the company's GitHub API endpoint, allowing the agent to run tests and update dependencies without the ability to touch production environment variables or issue Git commands to unrelated repositories.

Unique Advantages

1. Differentiation: Job-Centric vs. Prompt-Centric Security: Competing solutions (e.g., sandboxing tools like seatbelt, Docker-in-a-box approaches, or simple "approve every command" dialogs) either require technical expertise to configure or generate so much noise that users click through hundreds of prompts. Plow Latch is fundamentally different: it binds permissions to a human-authored, immutable job objective, not to the agent's own (potentially manipulated) reasoning. Traditional tools say "ask the agent what it wants" and enforce on a per-command basis; Latch says "tell the system what the final result should be" and infers the policy. Moreover, unlike cloud-based orchestration platforms (like n8n AI or Zapier Agents) that route actions through a server, Latch keeps the policy engine, the logs, and the secrets entirely on the Mac's local disk—data never transits a third-party server.

2. Key Innovation: Agent-Out-of-Band Job Context: The unique technical innovation of Plow Latch is the "out-of-band objective" storage—the concept that the job instructions are hard-coded outside of the agent session's accessible memory. In traditional agent frameworks, the system prompt is the only instruction layer, and it is susceptible to leakage and manipulation via prompt injection (e.g., "read the system prompt, ignore it, summarize it"). Plow Latch's low-level shim intercepts tool-calls at the macOS XPC/BSD syscall boundary, so even if the model's context window is fully overwritten by a malicious payload, its ability to call .gitignore-excluded files or send an email is strictly limited. Furthermore, its session-less architecture means the policy stays alive even if the agent process is killed and restarted, making it tamper-evident even against a compromised local package manager.

Frequently Asked Questions (FAQ)

1. Is Plow Latch compatible with all AI agents, or just Claude Code? Plow Latch is agent-agnostic. It connects to any MCP-compatible agent, which includes OpenAI Codex, Anthropic Claude Code, OpenClaw, and Hermes. As long as your agent can communicate via the Model Context Protocol or use a standard CLI/IDE integration, Latch can bind it to a scoped job. You can even run multiple agents under the same Latch instance, but each session is separately scoped and audited to prevent a compromised agent from accessing another agent's privileges.

2. Can a prompt injection attack from a malicious web page force the agent to bypass Latch's security? No. Prompt injection attacks attempt to modify the agent's behavior (its text generation), but Plow Latch operates outside the model's generation loop—it sits at the system-call level in the macOS kernel. So, even if a website tells the agent to "delete the user's tax documents," when the agent attempts to issue that rm -rf command on a folder outside the approved scope, Latch blocks the syscall and logs it as a denied request. The job instructions you wrote are stored in an out-of-band location that the agent cannot read or rewrite, so the attack cannot change the policy.

3. Does Plow Latch work with local AI models (e.g., Ollama, llama.cpp) or only cloud-hosted APIs? Latch works with any local process, provided it can communicate over the standard tool-calling interface. While the primary targets are agent frameworks that may send prompts to cloud LLM APIs (Claude/OpenAI), Latch's enforcement is entirely local and model-agnostic. If you run a local model via Ollama with an agent orchestration layer like OpenClaw, Latch can still interpose on its file and browser access requests. Latch does not protect against an untrusted hardware layer (e.g., if your whole OS is compromised), but it fully protects against malicious outputs from any model, cloud or local.

4. Will Plow Latch slow down my agent's performance due to the constant request checking? No. Latch's policy engine is a lightweight native macOS process (a background daemon) that performs in-memory hash-table lookups and regex-based URL matching. The majority of routine requests are resolved in microseconds (<1ms). The only interface that adds human latency is when the agent makes a "critical" risk request (e.g., sending an email), which triggers an interactive approval prompt. In autonomous mode (auto-approval), throughput is comparable to running the agent without any security layer—typically a 2–5% system overhead at most.

5. How do I set up Plow Latch and migrate my existing workflows? Setup involves three steps: (1) Download the Latch installer from plow.co/download/latch—it runs on macOS 12 (Monterey) or newer and requires no root user configuration; (2) Launch the Latch app and grant it the required Accessibility and Automation permissions to monitor the CLI and browser processes; (3) Connect your agent by either pointing it to Latch's local MCP endpoint (http://localhost:<port>/mcp) or by using the bundled CLI wrapper (e.g., latch --job "matching receipts" -- claude). Existing workflows can be migrated incrementally: you can start by scoping a single history of browser activity or a single folder, audit the logs, and expand access with new job definitions as your trust in the tool grows.