# Permissions, spend and audit checklist
The parts of a harness that survive the next model release. Context compaction
and retry logic dissolve into better models; what your organization allows does
not. Work through this once per deployment, then revisit quarterly.

## Sandboxing
- [ ] Agent tools run in a container, VM, or restricted user account - not your daily-driver shell
- [ ] Filesystem access is limited to the project directory (path-based access control)
- [ ] Network egress is limited to the domains the work needs (package registries, APIs)
- [ ] The sandbox cannot reach production databases, cloud metadata endpoints, or your password manager

## Credentials
- [ ] The agent gets its own API keys, scoped to the minimum permissions
- [ ] Keys are rotatable without touching other systems (separate identity for the agent)
- [ ] No personal access tokens, session cookies, or SSH private keys in the agent's environment
- [ ] Secrets come from a secret store or env vars, never from files the agent can also read out loud

## Spend limits
- [ ] A hard budget cap exists at the provider or proxy level (not just a warning)
- [ ] Loop protection: max steps / max wall-clock per task, with an alert when hit
- [ ] Someone looks at the bill weekly while the setup is new
- [ ] Long-horizon tasks are decomposed so a drift-off at step 50 cannot burn the whole budget

## Audit trail
- [ ] Every tool call the agent makes is logged somewhere you can replay
- [ ] Commits by the agent are attributable (separate git identity or sign-off)
- [ ] You can answer "what did the agent change this week" in under five minutes
- [ ] The instruction file's ratchet log is reviewed monthly and dead rules are deleted