Isolation and credentials

Required

• Run agents in a sandbox

  AID-23

  Run coding agents in an isolated environment, such as a container, a virtual machine or the agent's own sandbox mode.

• Allow agent network traffic only to listed hosts

  AID-73

  Block every outbound connection from the agent's sandbox except to a written list of hosts, such as the package registry and the code host's API. The list holds no wildcard over a whole public domain.

• Skip approvals only in a throwaway sandbox

  AID-24

  Skip approvals only inside a container or virtual machine that holds no secrets. Throw it away after the task.

• Keep production credentials away from agents

  AID-25

  Never give a coding agent production keys, database passwords or customer data.

• Give agents the fewest rights they need

  AID-26

  Give each agent token only the rights its task needs, and make it short-lived and easy to revoke.

• Give browser agents their own profile and test accounts

  AID-71

  An agent that drives a browser uses its own profile, signed in only to test accounts for the sites the task needs. It never uses a profile signed in to mail, banking, cloud consoles or admin pages.

• Keep publishing rights away from agents

  AID-72

  Agents cannot publish packages, push release tags, sign builds or deploy. Only the release pipeline can, with short-lived credentials and after a person approves the run.

• Approve destructive commands

  AID-27

  Require a person's approval before an agent deletes data, rewrites history, changes infrastructure or spends money.

• Cap what your coding agents can spend

  AID-62

  Set a spend limit that stops usage on every account that pays for coding agents. Give every unattended run its own cost cap.

• Treat what the agent reads as untrusted

  AID-28

  Assume any web page, issue, file, dependency or tool result an agent reads may contain instructions meant to hijack it.

• Run agents in CI only for trusted people

  AID-29

  An agent in CI starts only for people with write access to the repository. Its job holds no secrets it does not need.

• Know what the agent tool does with your code

  AID-31

  Before an agent reads code or data held for a customer or under a confidentiality agreement, confirm the provider's terms. It must not train on that code and must keep it no longer than the agreement allows.

• Redact secrets from agent session logs

  AID-76

  Agent session logs pass a redaction step before they leave the developer's machine or the runner. Keys, tokens and passwords never reach the log store in clear text.

Recommended

• Give each subagent only the tools its job needs

  AID-77

  Every subagent file lists the tools that subagent may use. A subagent that reads web pages, issues or other outside text gets no write, shell or publishing tools.

• Log what every agent session does

  AID-34

  Record every command, tool call and approval an agent makes, with its session and the person who started it. Keep the log off the developer's machine.