# Agent access

Choose how much your agents can reach, from your own account to an environment of their own.

Last updated 1 November 2026

An agent can run commands and use credentials without asking you to approve each action. The install line Cabane shows installs the Companion directly under your own computer account, which is level 1 below; pairing then connects that Companion to your Cabane account, whichever level it runs at. Levels 2 to 4 add access control.

You can add access control later. A harness sandbox is configured on the same install. For an environment of their own, pair it as a new device and move your agents to it, as [FAQ and Help](https://cabane.ai/docs/faq-and-help#how-do-i-move-it-to-another-computer-or-remove-it) describes.

## Why this is your choice, not a setting

Cabane has no sandbox setting of its own. The account, environment and harness configuration decide what an agent can do. [Cabane Companion](https://cabane.ai/docs/cabane-companion) covers the connection and trust model.

## The four levels

1. **Full access.** Run directly under your computer's account, as the install line does. Agents can use what that account can reach.
2. **The harness sandbox.** Run directly, with the harness restricting particular tools.
3. **Its own environment.** Run the Companion and harness together in an OrbStack isolated machine, a WSL distro with its Windows integrations disabled, or a Docker container. Provide only the folders and credentials the work needs.
4. **A fresh environment every session.** Start from a clean environment and discard it afterward. This adds a lifecycle to level 3; it requires your own setup around the runner.

Figure: Four levels of access: the account, a harness sandbox within it, a separate environment with selected resources, and a separate environment recreated for each session

## What each level does and doesn't stop

| Setup | What it limits | What remains available |
| --- | --- | --- |
| Full access | The operating system account's permissions. | Its files, credentials, commands and network. |
| Harness sandbox | Claude Code's sandboxed shell commands, or Codex's configured filesystem and command policy. | Default reads remain broad. Hooks, MCP servers and other processes are not all inside that boundary. See [Harness sandboxes](https://cabane.ai/docs/harness-sandboxes). |
| OrbStack isolated machine | Default Mac file sharing, host access and SSH-agent forwarding are disabled. | Explicitly mounted folders, supplied credentials, the internet and other OrbStack machines. Ordinary OrbStack machines expose `/mnt/mac`; use `--isolated`. |
| WSL with integrations disabled | Automatic Windows drive mounts and launching Windows programs are disabled. | Explicit mounts, Linux files and network access. An administrator can mount drives again; this is not a locked-down virtual machine. |
| Docker container | Host files are available only through the mounts and privileges you supply. | Mounted work, its home volume, supplied credentials and network access. Mounting the Docker socket gives control beyond the container; leave it out. |
| Fresh environment every session | Unpersisted changes from earlier sessions are discarded. | Anything deliberately kept outside it, including mounted work, credentials and remote services. |

OrbStack's isolated machines share a kernel; its [security model](https://docs.orbstack.dev/machines/isolated) does not promise protection from code actively trying to escape. Containers and WSL also need a considered configuration. Separate environments do not make shared credentials or writable mounts private from their agents.

## Which level, for whom

- **Full access** fits your own computer, for work you'd let the agent do as you.
- **The harness sandbox** is recommended for a direct install where agents' commands should write only to their working folder and reach only the network you permit. Reads stay broad.
- **Its own environment** is recommended for agents reading untrusted input, such as public websites or inbound mail, and for a machine shared by a team. Give work that must stay separate its own environments and credentials.
- **A fresh environment every session** is recommended for work where one session must not inherit another's local changes. [Server and VPS setup](https://cabane.ai/docs/server-and-vps-setup#a-fresh-environment-every-session) describes the runner hook and what you must build around it.

## Pick your page

For your own computer, follow [Mac setup](https://cabane.ai/docs/mac-setup) or [Windows setup](https://cabane.ai/docs/windows-setup). For a machine that stays online, follow [Server and VPS setup](https://cabane.ai/docs/server-and-vps-setup). Each starts with the install line, then describes its own environments.