Skip to main content
Status: partly live. The profiles, the Mac container path, and the GitHub secrets engine are in use; the Proxmox agent pool and its egress proxy are declared in infrastructure code with the converge role written, pending a first canary run. The roadmap tracks each workstream.
Stop asking the agent for permission. Put it somewhere it can’t hurt anything, then let it run.
Today’s safety model is fine-grained permission lists — roughly 640 allow/ask/deny entries rendered into Claude Code, Codex CLI, and the Antigravity (agy) CLI — running on a trusted Mac with the user’s full credentials a keychain prompt away. That model assumes a human is watching. Autonomous agents invert it: safety becomes the container boundary, and tool permissions inside it become maximally lenient. The agent gets --dangerously-skip-permissions precisely because there is nothing dangerous left to skip into.

​
The vendors all converged on this

All three CLI vendors publish the same guidance: bypass flags belong only inside an isolated environment, and the real controls are credentials, network egress, and git. The convergent model: the container is the boundary; bypass flags only inside it; default-deny egress; short-lived scoped credentials injected from outside; git as the safety net.

​
Three profiles

Profiles are defined once in nix-ai and rendered to all three tools by the existing formatter layer. See nix-ai for the rendering pipeline. One exception breaks the “configs only, no flags” shape: Antigravity has no settings key that can carry the posture — its predecessor hard-errors on the equivalent key and refuses to start — so every autonomous agy run must pass --dangerously-skip-permissions on the command line, and the launcher asserts the flag is present. The rendered settings block for it exists for parity, not effect.

​
What happens to the 640 entries

They survive only in interactive. The autonomous profile keeps a residual deny of roughly ten entries — gh repo delete, gh secret, force-push, registry publish — as a tripwire, not a wall. In autonomous, the real protection is:
  • Credential scoping — the agent holds only short-lived, narrowly scoped tokens. See Secrets.
  • Network boundary — an allowlisting egress proxy is the only way out. See Runtime.
A permission list cannot protect an unattended agent anyway: anything the config allows, a confused or compromised agent will do, and anything it asks about blocks forever with no human present. Boundaries that hold without a human are the ones made of credentials and packets.

​
Structural guarantees

Two invariants are enforced in code, not convention:
  1. Autonomous configs exist only inside a boundary — baked into the container image, or rendered by the converge role onto a pool guest. No code path writes a bypass-mode settings file onto a workstation filesystem. You cannot accidentally run yolo on the Mac host because the config to do so does not exist there.
  2. The entrypoint refuses to start unless AGENT_SANDBOX=1 is set and the uid is not 0. Claude Code independently hard-rejects bypass as root; the image runs as agent (uid 1000) with no sudo.
The container boundary is only as strong as what crosses it. Never mount host secrets, the Docker socket, or writable host paths into an agent container. The runtime page defines exactly what an agent container may see.

​
In this section

Runtime

The Mac container path, the static LXC pool, the egress proxy, and the run lifecycle.

Secrets

OpenBao as the single machine-secrets backbone — headless reads, short-TTL credentials — and the four-tier model behind it.

GitHub access

A separate OpenBao service engine issues short-lived GitHub App installation tokens.

Roadmap

Phases 1–7 and the repo ownership map.