# `Raxol.AgentClientProtocol.Ext.AttachPolicy.LocalNode`
[🔗](https://github.com/DROOdotFOO/raxol-agent/blob/raxol_agent_client_protocol-v0.1.0/packages/raxol_agent_client_protocol/lib/raxol/agent_client_protocol/ext/attach_policy/local_node.ex#L1)

The DEFAULT deny-by-default attach policy.

Grants iff the attach arrives over a transport that implies OS-level
co-residency; denies everything else — including a **nil / absent** transport
(fail-closed: if the Connection didn't say where the peer is, we do not guess).

```
authorize_attach(ctx):
  case ctx.transport do
    %{kind: :process} -> {:ok, grant(via: :local_node)}   # in-BEAM paired transport
    %{kind: :stdio}   -> {:ok, grant(via: :local_node)}   # pipe to a co-resident process
    _other_or_nil     -> {:error, :not_local}             # tcp, websocket, unknown, ABSENT
  end
```

`ctx.transport` is **Connection-sourced only** and NEVER peer-asserted, so a
network peer cannot present as `kind: :process` to steal a local grant.
LocalNode never reads `ctx.capability` (a token sent here is ignored, not an
error — stock-client compatibility).

Every LocalNode grant carries the same actor,
`%{"id" => "local", "kind" => "local_node"}`. A `ctx.actor` is not used:
under this policy nothing authenticates it, and a handler may have taken
it from the peer.

**Why this is not a hole:** anyone who can present a co-resident transport can
already read the journal files directly; the token would add zero security
against that principal. LocalNode refuses a *network listener* transport,
which is the actual attacker.

---

*Consult [api-reference.md](api-reference.md) for complete listing*