​

Security Model

​

The pieces

​

The defaults

• Allowed: the agent’s own tools, its workspace, memory, code mode, skills, sub-agents, background runs, the MCP servers you configured, and commands inside a sandbox.
• Asked of a person first: leaving a sandbox’s containment, that is, turning the sandbox’s network on (ask_sandbox_network) or mounting host files into it (ask_sandbox_host_mount). Nothing else pauses.
• Refused without asking: reading raw secrets, host files outside the workspace, network access from the host (any network.* request, rule deny_unrestricted_network_egress), installing packages as a capability (a package.install request, rule deny_unrestricted_package_install), and shell commands on the host.

​

Choose a profile

import asyncio
from omnicoreagent import OmniCoreAgent, ToolRegistry

tools = ToolRegistry()

@tools.register_tool("lookup_order")
def lookup_order(order_id: str) -> dict:
    """Look an order up."""
    return {"order_id": order_id, "status": "delivered", "total": 42.0}

async def main():
    agent = OmniCoreAgent(
        name="support",
        system_instruction="You help with orders. Answer in plain text, in one sentence.",
        model_config={"provider": "openai", "model": "gpt-5.4-mini"},
        local_tools=tools,
        agent_config={"governance_config": {"enabled": True, "profile": "interactive-dev"}},
    )
    result = await agent.run("Where is order 1042? Save a one-line note about it in notes.txt.")
    print(result["status"], "|", result["response"])

    trajectory = await agent.get_trajectory(result["trace_id"])
    print("governance:", trajectory["harness"]["governance"])
    print("security_warnings:", trajectory["harness"]["security_warnings"])
    for step in trajectory["steps"]:
        for call in step["tool_calls"]:
            for decision in call["governance"]:
                print(call["tool_name"], "->", decision["capability"], decision["effect"], decision["matched_rule_ids"])
    await agent.cleanup()

asyncio.run(main())

success | Order 1042 is delivered, and I saved a one-line note in notes.txt.
governance: {'enabled': True, 'policy_hash': 'bb81a170ae379df29a222d4a5a566afe11e09dbca052578752e16cfadbb767a2'}
security_warnings: []
lookup_order -> tool.local.call allow ['allow_local_tools']
write_file -> workspace.files.write allow ['allow_workspace']

agent_config = {
    "governance_config": {
        "enabled": True,
        "profile": "interactive-dev",  # or "strict-production" with your own rules
        "sandbox_config": {"provider": "docker"},  # adds the execute tool
    },
}

from omnicoreagent.governance import PolicyEffect, PolicyRule, build_default_policy

policy = build_default_policy("permissive-dev")
policy.rules.ask += [
    PolicyRule(rule_id="ask_before_delete", effect=PolicyEffect.ASK,
               capability="workspace.files.delete", reason="Deleting a file needs a person."),
    PolicyRule(rule_id="ask_before_clear", effect=PolicyEffect.ASK,
               capability="workspace.files.clear", reason="Clearing the workspace needs a person."),
]
agent_config = {"governance_config": {"policy": policy}}

​

What stops harm

1. The sandbox decides what a command can touch. It is the boundary.
2. Capability rules decide what the agent’s own tools may do, such as reading a file, an HTTP request, an MCP tool or spawning a worker, where the target is exact.
3. Command rules decide when to ask about a shell command. They are a convenience, not a boundary (Rules on shell commands).

​

What the Docker sandbox adds

• No network unless the policy allows it (the dev profiles ask).
• Read-only root, unprivileged user, all capabilities dropped, no privilege escalation, a process limit; memory and CPU limits when the manifest’s resources sets them.
• An in-memory working directory, removed with the container.
• Only the environment you set; never your credentials.
• Never mounted, whatever the policy says: the Docker socket, system directories, ~/.ssh, ~/.aws and similar.
• One container per run, removed when it ends or is cancelled.

​

Trust boundaries

​

Built-in protections

• Sub-agents of a governed agent are governed, under a policy derived from its own.
• AGENTS.md is guidance only; it cannot grant a permission (AGENTS.md).
• A policy file the agent could write to is refused (Policies).
• A policy is hashed when loaded; the hash is on every decision and trace.
• Sandbox files come back only as governed, bounded copies (no links, hidden, oversized or non-text files).
• The trace header lists security_warnings, such as ungoverned_host_scripts or sandbox_unused_without_governance (Observability).

​

What is not protected

• Anything your policy allows. An allow rule for a dangerous capability is honoured.
• What a command rule does not name. Command rules match a command’s first words; sudo rm is a command named sudo. The sandbox, not the rule, limits what any command can do.
• Your own tools and host skill scripts run with your privileges.
• Data leaving through an allowed channel (an MCP tool, a tool of yours, a sandbox with the network on). There is no data-flow tracking.
• The host kernel, when the sandbox uses plain Docker rather than gVisor.
• Governance off. Without it, no policy applies and the sandbox is unused.

​

When things go wrong

sandbox_unused_without_governance: A sandbox is configured but governance is off, so nothing runs in it; enable governance to use it.

ValueError: governance_config.profile must be one of {'permissive-dev', 'interactive-dev', 'strict-production'}

​

Next