Security

The Security screen is where operators control execution boundaries: what code can run, what network destinations are allowed, how prompts are filtered, and when temporary elevation is granted.

Sections

Sandbox

• Level — none, process, container, or stronger isolation modes (container requires Docker on PATH; probe via runtime.status before offering the option).
• Policy — read/write path allowlists, environment allowlist, and network policy snapshot.
• Denials — recent sandbox decisions that blocked an action.
• Flow preview — hypothetical decision for a flow/agent combination before dispatch.

The route-only sandbox screen (see Route-only screens) exposes the same policy shortcuts from workspace runtime sections.

Egress

• Policy — domain allowlist and block-by-default mode (toggle is guarded when the allowlist is empty).
• Decisions log — allowed and denied outbound requests.

Firewall and PII

Prompt firewall rules and custom PII redaction profiles are edited here. Changes take effect for subsequent runs without redeploying agents.

Break-glass

Time-boxed elevation requests (access.breakGlass) for emergencies. Grants and revokes append to the signed audit ledger. Use Governance › Audit for verification.

MCP operators

External agents connected via agentskit-os mcp-serve can read and update firewall, egress, and PII profiles at runtime through MCP security tools — see the CLI command reference.

Related screens