Part VI — OS confinement

A checklist for the software you ship {#S17}

There is a curated eight-layer checklist for securing the software a project actually ships — covering governance, identity, secrets, hardening the host, network, the application and its supply chain, monitoring, and backup/recovery. It is careful to draw a line: this checklist is about the shipped system, while the guard is about the build; the two are neighbors and must not be blurred. The honest note: it is guidance only. A checklist informs, but it secures nothing by itself, and the tools it names are not installed for you.

The locked room, and why the lock comes fitted but unturned {#S18}

There are three settings for how tightly a helper is confined: cooperative (no locked room — the opt-out), confined (today's default), and exclusive (which also blocks reading certain sensitive things). An unrecognized setting fails safe rather than quietly loosening. Two plain cautions belong here. First, the lock now comes fitted, but you still have to turn the key — by default agentteams writes the blueprint for the room, but it does not build it. The real enforcement is the AI tool's own operating-system sandbox, and the blueprint does nothing until someone wires it in. Second, this is proven on Linux; on Macs it is advice, not a proven lock (it has not been tested there), and on Windows there is no built enforcement at all. On a system that can't enforce it, the tool refuses to pretend it can (it fails safe) unless you explicitly allow the unenforced mode. The lock is also set to stay shut if it breaks: when the AI tool's own sandbox cannot start (on Linux it needs two small programs, bubblewrap and socat), the tool now refuses to start rather than quietly running without the lock, which it did before a 2026-09-30 fix. That Linux lock has not yet been checked end to end. It also marks certain control files as never-writable, so a confined helper can't reach out and disable its own guardrails.

A checkpoint before every move {#S19}

A checkpoint runs before each action a helper takes — catching moves that the front-door locks never see. It flatly denies clearly-dangerous writes (secrets, personal information, trick-text) and asks a human first before risky commands (installing software, piping downloaded content into a shell, force-deleting, and the like). Before it inspects anything, it first checks that the inspector itself hasn't been tampered with, using the tamper-evident seal; if it has, the checkpoint asks rather than silently allowing. One plain caution: by default this checkpoint is permissive — it only becomes strict once you turn on the locked-room settings. And the honest ceiling: it does not stop a determined insider who edits several files at once — it raises the cost from one quiet edit to three, each of them visible in the project's version history.