enclave-seatbelt

You can sandbox agent shells on macOS using the enclave-seatbelt skill, which leverages `sandbox-exec` to enforce strict filesystem restrictions. It limits access to only the workspace directory, /tmp, and system libraries, preventing unauthorized file operations.

Yes, you can restrict network activity for agents in macOS environments by utilizing the `pf` utility. This skill blocks all network access except for loopback connections to specified proxy and authorization ports, ensuring agents cannot communicate externally.

Process restriction works by limiting the agent shell to only access the shell binary and standard utilities in /usr/bin and /bin. This prevents the execution of unauthorized processes and contains the agent's operational scope within the macOS sandbox.

The best way to enforce policy on autonomous agents is by applying fine-grained access restrictions at the filesystem, network, and process levels. This approach ensures broad permissions are contained, mitigating the risk of harmful behaviors and security breaches.

No, this macOS sandboxing approach does not require any special dependencies. It operates by directly utilizing the native `sandbox-exec` and `pf` utilities already available on macOS to enforce the required security policies.

You should not use sandbox-exec for agent execution if your workflow requires the agent to have broad network access or the ability to write outside of the designated workspace and /tmp directories, as these actions are strictly blocked by the policy.