Skip to main content
Superseded by Agent identity and accessUse Agent identity and access for the current trust boundary and live status. This page is a superseded record.
A harness is trusted when the estate can prove what it did. Everything else is untrusted, and the difference is enforced by what each class can reach. Several AI coding harnesses run against this estate. They are not equally constrained, and the difference is not a matter of trust in a vendor. It is a matter of which credentials and which operating-system identity each class is given. A harness without write access cannot push a commit, whatever its instructions say.

​
The two classes

Current examples include Claude Code, Codex, and Antigravity (agy) in the trusted tier, and Gemini and Cursor Agent in the untrusted tier. These are public products; naming them is what makes the tier assignment auditable. Cursor Agent has no local install. The local Cursor command-line tool was removed in nix-ai#2483, and cursor-agent runs only in a sandbox container, through the dispatch path. OpenCode has wrappers with different trust boundaries. opencode is the trusted local launcher defined in the host configuration. opencode-remote starts a fresh sandbox session through the dispatcher. opencode-wall is the local Seatbelt-walled launcher for untrusted use (nix-ai). See Agent identity and access for the command and identity details. opencode-wall is the untrusted local tier. It runs under a deny-default macOS Seatbelt profile, enabled by default on macOS through the programs.opencode.sandbox.enable option in nix-ai. The profile denies the keychain, ~/.doppler, ~/.ssh, the ssh-agent socket, and loopback except the configured model proxy. It blocks app launches through open, AppleEvents through osascript, launchd job creation through launchctl, and sudo. It also denies:
  • creating, removing, and renaming .git entries;
  • hooks and config under any gitdir name;
  • hard links;
  • writes to CLAUDE.md, AGENTS.md, GEMINI.md, and .cursor.
opencode-wall’s .git hardening and FSEvents mach-lookup allowance are in nix-ai#2484. File watching still works while the profile denies git metadata changes and writes to git hooks/config. By default, opencode-wall accepts only standalone clones under ~/opencode-work. The profile limits what opencode-wall can reach. It does not separate an identity because it runs as the operator’s account.
Trusted git in an OpenCode work rootDo not run trusted git in the OpenCode work root with the clone’s own config. Run it with hooks and fsmonitor turned off:
Or fetch into a separate trusted repository, outside the work root.
Activation status is supersededUse Agent identity and access for the current OpenCode activation status.

​
Why the identity is the boundary

The trusted class runs as its own operating-system account. That account is the only identity allowed to escalate privilege without a human present. Its grant is scoped to a single exact command rather than a general one. The human operator’s interactive account keeps a biometric gate on every escalation. So an agent that has strayed into that account still cannot converge a machine. This puts the boundary somewhere an audit log can see it. A run either happened under the automation identity or it did not.

​
What an untrusted harness still gets

Untrusted does not mean unusable. An untrusted harness reads code, writes files in a working tree, runs tests, and reads the specific leaf secrets a task needs. What it does not get is a path to change shared state: no forge write, no credential minting, no convergence, no privilege escalation. A change it produces reaches the estate the same way a human’s does. It gets reviewed, through a pull request opened by an identity that is allowed to open one.

​
Moving a harness between tiers

Promotion is a change to capability grants, not to a document. A harness joins the trusted class only when three things are true. It has its own operating-system account. It has its own bounded role in the central store. And it has scoped forge write access. Until all three exist, it is untrusted regardless of how it is described.