GitHub Next's Ace runs agents with your privileges: 7 facts from its trust model, and 6 checks before you share a channel

Ace is an open-source collaborative coding environment created by GitHub Next. It allows people and agents to work together in channels that run on individual machines. The trust model of Ace is straightforward: the host process runs on your machine, using Bun 1.4 or later, or as a Mac app for Apple Silicon devices running macOS 15 or later. Channels are stored under $ACE_HOME on the machine and default to ~/.local/state/ace. Each channel is a chat with an agent, plus lanes for isolated work.

To use Ace, you need Tailscale running and an Anthropic or OpenAI key in the Settings → Providers section. Ace agents run with your user privileges, meaning they can execute any shell command and read, change, or delete files beyond the project directory. There is no sandbox between the agent and your user account, and channels are not security sandboxes. A channel is more like granting a teammate an SSH session on your machine than sharing a document.

Ace's trust model is built around the tailnet, which is the sole authority for team membership and collaboration access. There are no separate accounts, invitations, or team access controls within Ace. Adding someone means adding them to the tailnet in the Tailscale admin console. Your GitHub login is linked to Ace, but it sits on top of the tailnet access control, not instead of it.

Two default-off capabilities allow other people to spend your privileges: Agent access (if teammates can ask the agent to run commands) and Desktop tools (if agents can operate the Mac's apps).