Enable protection
The Security Module is an optional add-on, disabled by default. Enable it in Settings, then use Security Center to configure file and network protection separately.
Protection applies to agents launched through Haicue. Launch a new session after enabling or changing the policy: an existing process keeps the file protection it started with.
Set access rules
Rules can allow access, ask you, or deny it for a file path or network destination. An explicit deny takes precedence. Blacklist mode allows unmatched activity; whitelist mode asks about unmatched observations.
File protection is available on macOS. Its whitelist mode keeps baseline access needed by the agent and local tools, including access within the home directory. It is not a blanket block on every unlisted file. Linux supports network protection, but not file protection.
Review a question
When a policy question appears, inspect the session, operation, and requested resource before choosing a response. Depending on the request, you can allow it once, for the session, or persistently, or deny it.
A macOS file denial has already been enforced by the operating system. An exact persistent allow takes effect on the next agent launch; allowing that question cannot retroactively complete the blocked operation.
Read the audit history
Use Security Center’s history to review observed requests and decisions. Entries record the agent, session, thread at the time, source, and observation coverage. This helps you connect a request to the work that caused it.
Coverage is partial. Network history records traffic seen by the proxy. HTTPS observations identify the destination domain and port, not the encrypted URL path. Allowed file reads and writes are not listed; concrete denied attempts can be reported when macOS log access is available.
Use file tracking to review captured changes to files. Security history answers access-policy questions; Track helps explain what changed.