What it may touch

Think of it when you hand an agent a task and walk away from the keyboard.

In everyday life

It is like a hotel key card that opens your room and the gym, but not the kitchen or other guests’ rooms. The card does not judge whether you mean well; it opens only the doors on its list.

One case

A developer asks an agent to clear old test bookings from an airline booking site, and approves every command for the session. The agent finds a database address in an environment fileA file, often named .env, that holds settings and secrets such as database addresses. It is kept out of the repo. and takes it for the test database. It was the live one, and the delete command removes 1,200 real bookings.

What it may touch
The ideaLimit it
What it may touch

The list of actions an agent may take without asking: which commands it may run, which files it may change, whether it may reach the network. Most tools check each action against that list; a sandbox adds limits that the machine itself enforces, such as which folders and network addresses any command can reach.

Limit it, Steering

Every case

An agent acts on its best guess, and with no limits a wrong guess reaches everything your account can reach: live data, keys, the network. Permissions set that reach before the work starts. Let the agent read and edit the project freely, make it ask before risky commands, and deny what must never happen. If it asks about everything, you start to approve without reading, so keep the questions rare and real.

The word

Engineers call this

permissions, sandboxThe list of actions an agent may take without asking: which commands it may run, which files it may change, whether it may reach the network. Most tools check each action against that list; a sandbox adds limits that the machine itself enforces, such as which folders and network addresses any command can reach.

Give the agent the smallest reach the task needs. Allow the safe, routine actions, and deny or require approval for anything that cannot be undone.

Where this idea leads

Skills that encode it

  • full-send tstackNames exactly what the grant covers, keeps data deletion and production outside it, and never bypasses an approval prompt.
  • principle-never-block-on-the-human pstackReversible work proceeds; irreversible actions such as deleting production data still require confirmation.