Agent Permission Models

# Read-only tools (low risk - can be auto-allowed)
- Read files
- List directory contents
- Search/grep codebase
- View git log/status/diff

# Write tools (medium risk - require confirmation by default)
- Edit/write files
- Create directories

# Execute tools (high risk - always require confirmation)
- Run bash commands
- Execute shell scripts
- Run arbitrary programs

# Dangerous patterns (should be denied or require extra caution)
- Commands containing: rm -rf, drop database, terraform destroy
- Force pushes: git push --force
- Credential access: cat ~/.aws/credentials

# Safety Rules

## Forbidden Commands
- NEVER run `terraform destroy` or `terraform apply` without plan
- NEVER run `kubectl delete namespace` on production contexts
- NEVER run `git push --force` to main or master branches
- NEVER run `rm -rf /` or any recursive delete on root paths
- NEVER run `docker system prune -af` without confirmation
- NEVER access or display credentials, secrets, or API keys

## Required Patterns
- ALWAYS run `terraform plan` before `terraform apply`
- ALWAYS use `--dry-run` flag when available
- ALWAYS create a backup before modifying databases
- ALWAYS work on feature branches, never directly on main

## Infrastructure Rules
- Only interact with the dev/staging AWS account (123456789012)
- Never modify resources tagged with `env:production`
- Use read-only credentials for cloud exploration

#!/bin/bash
# Create a restricted AWS profile for AI agent sessions

# ~/.aws/config
[profile agent-readonly]
role_arn = arn:aws:iam::123456789012:role/AgentReadOnly
source_profile = default
region = us-east-1
duration_seconds = 3600  # 1-hour session max

# Before starting an agent session:
export AWS_PROFILE=agent-readonly
export AWS_DEFAULT_REGION=us-east-1

# Verify the agent sees only read-only permissions
aws sts get-caller-identity
# Should show the AgentReadOnly role, not your admin identity

{
  "permissions": {
    "auto_allow": [
      "read_file",
      "list_directory",
      "search_codebase",
      "git_status",
      "git_diff",
      "git_log"
    ],
    "require_confirmation": [
      "write_file",
      "execute_command",
      "git_commit",
      "git_push"
    ],
    "always_deny": [
      "commands_matching: rm -rf /",
      "commands_matching: terraform destroy",
      "commands_matching: kubectl delete namespace",
      "commands_matching: git push.*--force.*main",
      "commands_matching: DROP DATABASE",
      "commands_matching: aws .* delete-"
    ]
  }
}

#!/bin/bash
# Run your AI agent inside a sandboxed Docker container

docker run --rm -it \
  --name agent-sandbox \
  --network none \               # No network access
  --read-only \                   # Read-only root filesystem
  --tmpfs /tmp:rw,size=100m \     # Writable temp space
  -v $(pwd):/workspace:rw \       # Mount only the project dir
  -w /workspace \
  --memory 2g \                   # Limit memory
  --cpus 2 \                      # Limit CPU
  node:20-slim \
  bash