Permissions

Constrain untrusted guest filesystem, process, network, environment, and host function access.

Pass a permission tree when creating the VM. The trusted sidecar enforces it for every guest operation. Hosted VMs take the same serializable tree in their creation config or a later complete v1.config.set replacement.

import { AgentOs, type Permissions } from "@rivet-dev/agentos-core";

// Core accepts the kernel permission tree plus policies for trusted host
// bindings and mounts.
const permissions = {
	network: {
		default: "deny",
		rules: [
			{
				mode: "allow",
				operations: ["*"],
				patterns: ["dns://api.example.com", "tcp://api.example.com:*"],
			},
		],
	},
} satisfies Permissions;

const vm = await AgentOs.create({ permissions });

await vm.dispose();

The tree has one scope per capability: fs, network, childProcess, process, env, and hostFunction. A scope can be "allow", "deny", or a rule set with a default mode and rules that match operations and target patterns.

Your policy is merged over the default, so an omitted scope keeps its default. By default the guest behaves like a sandboxed machine: its virtual filesystem, processes, environment, listeners, and loopback networking work, and outbound network access is limited to the sidecar’s default allowlist. Library host functions are governed by the hostFunction scope.

See the Security Model for the trust boundary these policies enforce.