Understand local AI processing and browser permissions

A useful AI environment needs access to the data for a task. That does not require unrestricted access to a PC. Naidan uses the browser’s sandbox and permission model as the starting point, then implements models and tools inside it.

Follow the OS and browser boundaries

The OS on this PC

NaidanBrowser

NaidanRuns inside the browser

Attempt a direct OS operation

Direct access prevented

Browser-mediated APIs

Scope and conditions depend on the API

Selected files and folders

Selected scope; writing has separate permission.

Clipboard

Reading and writing have different browser rules.

Local serverHTTP API → localhost

HTTP to the endpoint you specify.

The localhost server runs separately, with its own OS permissions.

OS permissions still apply. File, clipboard and network access also follow browser rules and site policy.

Naidan runs inside the browser, which runs on the OS. Direct OS operations stop at the browser boundary. Browser APIs mediate file, clipboard and network access under different conditions. This can include an HTTP connection to a localhost server.

01 · You choose the input

Text and selected files enter the conversation. File and folder access follows the browser’s APIs and grants. A linked folder can be writable when explicitly permitted; the boundary is controlled access, not a ban on useful file operations.

02 · The browser runs the model

A supported in-browser model processes input on the device. WebGPU can use the device’s graphics processor, while WebAssembly runs compiled code in the browser. Availability and performance depend on the model, runtime and browser.

03 · Connections have a purpose and a destination

Getting model files contacts a model provider. Choosing an external engine or a network-enabled tool adds its own connections. The Local-only deployment narrows allowed destinations with Content Security Policy (CSP). Browser developer tools help you inspect requests; a local engine such as llama.cpp server runs with its own native-process permissions.

Limit external connections with the Local-only edition