Environments

An agent's environment determines what it can read, change, or execute. The working directory and installed tools affect the result of a run. Permissions and network access matter too, as do credentials.

Make The Starting State Explicit

A reproducible run records the repository revision and runtime version. It also records the dependency lockfile and relevant configuration. “It passed locally” is incomplete if the next run uses another database, an untracked file, or a different package version.

The control panel should associate each run with a workspace. The task must identify that workspace before the agent starts. A path in a prompt does not prevent a process from writing elsewhere; operating-system permissions and sandbox rules enforce that boundary.

Choose A Permission Mode

Agent applications trade speed for safety through permission modes. Claude Code permissions range from asking before every action to accepting file edits automatically. It also offers a read-only plan mode and a mode that skips approvals entirely. Codex pairs a sandbox setting with an approval policy, and its sandbox can limit the agent to reading files or to writing inside the workspace.

Match the mode to the cost of a mistake. A read-only mode suits exploration of an unfamiliar codebase. Routine edits in a committed repository suit automatic edits with approval for shell commands. Allow and deny rules can approve safe commands in advance and refuse risky ones without a prompt.

Separate Concurrent Work

Two agents editing the same files can overwrite each other or test a mixture of changes. Git worktrees provide separate working directories attached to the same repository. Each task gets its own branch. Integrate only after its checks pass.

Worktrees do not isolate everything. Processes can still share ports and databases, along with caches and external accounts. Assign separate test data and ports where concurrent tasks could interfere.

Guard The Fast Modes

A mode that skips approvals removes the person who would have caught a destructive command. Pair it with a hook that blocks commands such as a recursive delete or a hard reset before they run. The block holds even if a retrieved web page tries to talk the agent into running one.

A production pipeline can run the agent in an isolated AI sandbox with no right to push or merge. A deterministic engine opens the pull request after the checks pass. The agent proposes changes and the engine decides what leaves the agent sandbox.

Classify Environment Failures

A missing executable or expired credential is an environment failure, as is an unavailable service. Passing that error back to an implementation agent repeatedly may produce unrelated edits. The runner should record the failure and stop or retry according to a defined policy.

Keep credentials outside prompts and tracked files. A local task that only inspects code does not need permission to deploy the application.

September, 2026