Overview The gateway enforces security policies that control what the agent can do. This includes sandboxing command execution, restricting tool access, and requiring user approval for dangerous operations.
Security Modes Unrestricted
Sandboxed (Default)
Locked
All tools are available with no approval required. Suitable for trusted environments where the agent has full system access. { "agents" : { "defaults" : { "security" : { "mode" : "unrestricted" } } } }
Tools are available but dangerous operations require user approval. This is the recommended mode for most deployments. { "agents" : { "defaults" : { "security" : { "mode" : "sandboxed" } } } }
Only safe tools (memory, tasks) are available. Command execution and browser are disabled. Suitable for customer-facing agents. { "agents" : { "defaults" : { "security" : { "mode" : "locked" } } } }
Fine-grained control over individual tools:
{ "agents" : { "defaults" : { "toolPolicies" : { "exec" : { "mode" : "approval-required" , "blockedPatterns" : [ "rm -rf" , "sudo" , "chmod 777" ], "allowedPaths" : [ "/Users/sem/projects/" ] }, "browser" : { "mode" : "allowed" , "blockedDomains" : [ "banking.example.com" ] }, "memory_store" : { "mode" : "allowed" } } } } }
Policy Modes Mode Behavior allowedTool executes without approval approval-requiredUser must approve each use blockedTool is not available
Exec Approval Flow When the agent requests a command that requires approval:
Command displayed
The command is displayed to the user (in dashboard or channel)
User reviews
User reviews the command
User decides
User approves or rejects
Execution or alternative
If approved, the command executes normally. If rejected, the agent is informed and can try an alternative.
Gateway Authentication Without authentication, anyone with network access to the gateway port can send messages to your agent. Always enable auth for production deployments.
{ "gateway" : { "auth" : { "enabled" : true , "token" : "your-secret-token" } } }
Recommendations
Personal use Sandboxed mode with approval for destructive commands
Team use Sandboxed mode with restricted paths
Customer-facing Locked mode with only safe tools
Development Unrestricted mode for rapid iteration
