forked from EduCraft/curriculum-project-hub
13 lines
468 B
Markdown
13 lines
468 B
Markdown
# Confine the agent runtime and protect service credentials
|
|
|
|
Type: task
|
|
Status: open
|
|
|
|
## Question
|
|
|
|
Make the real Claude SDK/Bash execution surface uphold `AgentFileOp.Authorized`:
|
|
deny sibling tenant workspaces and service files, expose only the minimum safe
|
|
process environment, use SDK credential protection for secrets, and add an
|
|
actual Linux sandbox test proving another workspace and every non-provider
|
|
credential are unreadable while required tools still work.
|