Skip to main content

Agent guardrail & permission standard

The sandbox every coding agent runs inside. This is what makes "agents build" safe: an agent has exactly the access its task needs and no more, and it physically cannot reach the things reserved for human authorisation.

The guardrails​

  • Filesystem allowlist — an agent works within its repo/worktree; paths outside are denied.
  • Network allowlist — outbound access limited to declared registries and services; no open egress.
  • Credential scoping — short-lived, least-privilege credentials, scoped to the task. Secrets never enter code, config, prompts or the agent's context window (see Secure-by-default).
  • No direct production access, ever — agents build and prepare; a human authorises the irreversible. There is no path from an agent session to a production deploy.
  • MCP-server allowlist — only vetted tool servers are connectable; new ones pass the intake gate first.
  • Rate & spend limits — per-session token and action budgets with anomaly alerts, so a runaway loop is capped, not catastrophic.
  • Action logging — every tool call is logged, feeding the provenance trail and incident blast-radius queries.

Configuration as code​

The guardrails aren't set by hand per session — they're the canonical config every squad inherits, implementing this standard: CLAUDE.md/system-prompt templates, hook definitions (lint/test/scan on write), MCP configs, model pinning, per-repo overlays. Changed by PR, reproducible, auditable across UK and India. Lives in the project scaffold and the toolkit.

Standards referenced​

NIST AI RMF, OWASP LLM Top 10, least-privilege. The guardrail standard and the security allowlist / radar share one source of truth — anything an agent can reach was vetted through the same intake.