The Semi-Sandbox — Why Not Be Kinder to Your Agent Colleague?

When people talk about agent safety, their first question is often:

“How many restrictions should we add?”

We care more about a different question:

When an agent is restricted until it can no longer get anything done, is it still an assistant?

A fast horse can fall. Of course it can.

The simplest prevention is to chain all four of its legs. It will never run out of control again—and it will never take you anywhere.

Agotalk does not want to build that kind of harness.

First, two terms.

A “sandbox” confines an agent to a small part of the computer. It may see only designated files and perform only designated actions. The moment it crosses a boundary, it stops and asks you.

A “harness” is the working system that lets an agent keep going, leave a record, and resume after failure.

We believe a good harness should not make an agent do less. It should give the agent direction, evidence, and a way back.

That is Agotalk’s semi-sandbox strategy.

Imagine asking a colleague to prepare a bid proposal

The requirements are in the project folder.

The client’s PDF is in Downloads.

The brand images are on the Desktop.

The product demo is a video that needs transcoding.

The finished package belongs in a shared delivery folder.

Now imagine that your colleague has to ask at every step:

May I open Downloads?
May I read this image?
May I use the transcoding tool?
May I write to the shared folder?
May I continue now?

In the end, you are still the busiest person in the room.

You did not delegate the work. You simply found a new way to operate the computer yourself.

That is the reality of many agents today. The model may be intelligent, but the materials it sees are fragmented and the actions it can take are disconnected. Users keep moving files, granting access, restating context, and watching progress.

Agotalk chooses to put a complete piece of work in front of the agent—not a long sequence of permission quizzes.

It can use absolute paths and files in personal folders, and it can call the local capabilities needed to finish the job. The proposal is one piece of work, so the agent should have room to carry it from beginning to end.

We need to be clear about the boundary: Agotalk is not a full operating-system sandbox.

Within a managed task, the agent can reach files that the current Mac user can already access. This is not a product where giving the agent one file guarantees that it can never see anything beside it.

Agotalk records the tools an agent calls, the commands it runs, and the results it receives. But it is not currently an operating-system-level, file-by-file monitor. It does not automatically turn every file opened inside a command into a complete access manifest.

Agotalk is therefore designed for your own Mac, projects you trust, and work you have deliberately authorized. Unknown code, computers shared with strangers, and the highest production privileges should not be handed directly to this mode.

Five products place the user in different default positions

Codex, Claude Code, Gemini CLI, and OpenHands all take agent safety seriously. None of them is simply wrong. They protect different things first.

Looking only at their default or recommended ways of working, the distinction can be summarized like this:

Product	Default approach	What an ordinary user feels	Better suited to
Codex	Work automatically within the project, then ask when leaving it or using the network	Smooth inside the project; possible interruptions across folders	Work centered on a code project
Claude Code	Draw a safe boundary around commands, then request permission beyond it	Fewer prompts for routine commands, though different tools may have different boundaries	Development work that benefits from explicit command boundaries
Gemini CLI	Let the user choose among isolation levels	Flexible, but requires understanding and configuring more options	People who want to configure their own execution environment
OpenHands	Put the agent in an isolated environment, then give the project to it	A stable environment, but local materials and tools need preparation	Remote, multi-user, and repeatable tasks
Agotalk	Establish that this is a trusted personal workplace, then let the agent own the complete task	Fewer routine interruptions; attention stays on business decisions	Desktop work spanning files and tools over hours or days

This table is not comparing the maximum permission each product can ever receive. Codex can switch to Full access, Claude Code can add allowed locations, Gemini can choose a less restrictive mode, and OpenHands can mount more local folders.

The real difference is the position in which each product places the user by default.

The mainstream approach of the other four is to draw an area in which the agent can move freely, then expand it when the agent reaches an edge.

Agotalk begins by confirming that the agent is in a trusted personal workplace. It gives the agent room to finish the whole job, while governing facts, the environment, and the way back from mistakes.

The former gives priority to reducing the agent’s effect on the computer.

The latter gives priority to reducing the computer’s demands on the person.

Why not be kinder to your agent colleague?

Imagine asking a colleague to finish an important proposal while giving them only half the requirements, a few screenshots stripped of context, and an account that cannot open attachments.

No matter how capable they are, the chance of success will be poor.

Agents are no different.

Being “agent-friendly” does not mean indulging the agent. Nor does it mean pouring every available piece of information into the model without judgment.

It means that the files, history, tools, identity, and environment genuinely needed for the current task should reach the agent completely and reliably—not be fragmented or lost between layers of permissions and windows.

You give the agent the complete workplace, the history of the matter, and the tools needed to finish it for real.

The agent repays that trust not with a prettier answer, but with less guessing, fewer interruptions, and a higher probability of delivering usable work.

The causal chain is simple:

More complete, trustworthy task context
  → fewer information gaps
  → less guessing and repeated confirmation
  → more continuous execution
  → a higher probability of task success

We have not dressed this product judgment up as an unverified set of success-rate numbers.

But the direction is clear: making the workplace friendlier to the agent is ultimately about winning better results for the user.

Everything is a file

Another Agotalk belief is: Everything is a file.

Important facts should remain somewhere both a person and an agent can find again, read, compare, and take over.

Return to the bid proposal.

The agent works for two hours and the interface announces “Task complete.” But there is no finished file, no preserved references, and the working record disappears when the window closes.

That is not completion. It is only an attractive success animation.

In Agotalk, the result should become a file. What ran, how far the work progressed, and where it failed should also leave a durable record. Close the interface and those facts must still be there when you return.

The next morning, you should be able to see:

how far the task progressed;
which materials and tools it used;
where it failed;
which registered outputs it left behind;
where to continue.

File truth is not a technical preference. It is a way to release human attention.

You should not have to watch every step. When you need to return, the facts should still be there.

Manage the machine less; hold the result accountable

A semi-sandbox is not a free-for-all. Agotalk puts guardrails where users can actually feel their value.

It uses the tools it brings

Agotalk uses a fixed toolset installed with the software. It does not quietly depend on whatever happens to be installed on your computer.

That avoids “it worked on the developer’s machine but not the user’s.” It also prevents an agent from handing over a complete-looking result when the underlying work never truly ran.

If a required capability is missing, the system should say so plainly—not pretend to succeed.

Two agents cannot silently write over the same work

If two tasks try to change the same project at the same time, the later task stops explicitly instead of quietly overwriting the first.

When parallel work is needed, each task can use its own isolated working copy.

Stop means more than stopping the spinner

When a task is stopped, Agotalk tries to stop the background child processes it started as well.

If it cannot confirm that everything stopped, the system should say “not yet confirmed” rather than displaying an unknown state as success.

Credentials have a scope

Secrets are not casually inherited from the user’s entire computer environment. They are assigned to tasks at a global or workspace scope. Command results returned to the conversation, along with command logs managed by Agotalk, are scrubbed of known sensitive values.

Per-task least privilege is not yet complete. While a command is running, a program’s own logs may briefly contain plaintext before cleanup at task completion. Arbitrary files generated by an agent are not comprehensively scanned and automatically redacted either.

Routine work should therefore use limited, revocable credentials. Do not hand the highest production administrator key to an unattended task.

Accidental deletion can have an extra way back

Agotalk offers an optional Safe RM. When enabled, ordinary deletion prefers moving files to the macOS Trash.

It is currently off by default and cannot cover every form of deletion. It is an extra, optional guardrail—not the whole of Agotalk’s safety promise.

We would rather state what is not protected than purchase temporary trust with the phrase “completely safe.”

Where does a semi-sandbox fit—and where does it not?

It fits:

your own Mac;
projects and materials you trust;
real work that needs to cross folders and tools;
tasks that continue for hours or days without requiring you to watch constantly.

It does not fit:

opening unknown projects that may contain malicious content;
sharing one execution environment with strangers;
giving unattended tasks the highest production privileges.

For those jobs, place the agent in a temporary, isolated computer environment and destroy the whole environment when the task ends.

A semi-sandbox is not a substitute for strong isolation.

It is a deliberate tradeoff among capability, friction, and results for a trusted personal desktop.

One final test

When evaluating a desktop agent, do not ask only:

“How many permission prompts did it show?”

Ask instead:

Can it actually complete the whole job?
Did it receive complete, trustworthy task context?
After the person leaves, do the results and records still exist?
Can two agents silently corrupt the same work?
Is there a way back from mistakes?
Does the system honestly state what it cannot protect?

The stronger the agent becomes, the less safety can depend on a single sentence: “Please operate carefully.”

But safety does not require tying the horse’s legs together.

Agotalk’s choice is:

Give the agent the ability to reach the destination. Let the harness govern direction, facts, and the way back. Return the user’s attention to the work that truly matters.

We do not want to win a contest over who can impose more restrictions on an agent.

We only want to build agents a comfortable home: a complete workplace, reliable tools, and enough room to use their full ability.

A harness should help them arrive—not hobble their legs with bureaucratic sandboxism.