# How agents are contained

> What an agent can and cannot reach while it changes your app, how its spending stops, and what it can never do.

An agent is an AI coding assistant that runs on our build machine. It works on one request in one app. These limits hold for every run.

## A closed space

Each run starts inside the operating system's own sandbox. A run does not start without it.

- **Files.** The agent reads and writes your app's code folder. It cannot read the other apps, nor the folders where we keep their data and our own.
- **Network.** It reaches two services: the package registry it installs code from, and the AI provider that runs its model. Every other address is refused.
- **Commands.** Every command it runs stays inside the sandbox. A command the rules do not allow is refused, never asked about.
- **Secrets.** The key to the AI provider lives in the agent's own process only. It is removed from every command the agent runs, and it never appears in a log.

## A spending limit

Each run is measured as it goes, at the model's public price. A run that reaches its limit (one US dollar by default) is stopped at once. A model without a public price is refused before it starts. The card of each run shows what it spent.

## What an agent cannot do

- **Release or deploy.** Only you do that, from the portal.
- **Approve its own work.** Only your answer approves a card.
- **Wait in a chat.** It asks on the card and stops. Nothing runs while it waits for you.
- **Reach your live app.** It works on the working copy and its separate data.

## What an agent must do

The rules every agent follows are written down and shipped with the toolkit, so they always match the toolkit version your app uses. Among them:

- describe a change in the app's own notes before it writes the code;
- run the app's checks (it compiles, the tests pass, the code style holds) before it shows you anything;
- write one changelog line for each change your users can see;
- show every visible change as a card with a before and an after;
- save its work in the app's history before it sends the card, so nothing is lost if a run stops.

See [The agent kit](https://golocomotive.fr/docs/extend/agent-kit.md).

## What is not contained yet

The working copy of an app runs on the build machine as our own system user, and it runs code an agent wrote. It is not in the agent's sandbox, and other local services of the build machine are reachable from a run. One system user per working copy is the next layer. It is not built yet. The live apps on the production server already run this way: see [Security](https://golocomotive.fr/docs/trust/security.md).