Guardrails around approvals
Shell commands and custom-tool scripts that try to send or publish directly are refused in code, and server fetches only reach public addresses. Not a network sandbox, and the docs say so.
Updated 2026-10-13
An approval is only worth something if there is no way around it. Two routes could go around one: shell commands on the agent’s computer and the scripts of custom tools. Both are guarded.
Commands and scripts that are refused
| Refused | Use instead |
|---|---|
An HTTP write straight from the shell (curl -X POST, --data, -F, --json, and the same for wget, httpie) | An approved tool, or a custom tool, which asks first. |
git push | github_open_pr, which pushes the branch after approval. |
Publishing a package (npm publish, twine upload, cargo publish, gem push) | Ask you to publish it. |
A deploy command (vercel, netlify, wrangler, firebase, fly, heroku, railway, render with deploy or prod) | deploy_website, which asks first. |
A GitHub write through gh (create, edit, merge, comment, close, delete, or gh api with a write method) | github_open_issue or github_open_pr. |
Uploading to cloud storage (aws s3 cp, gsutil cp, rclone) | save_to_library, or ask you. |
Copying to another machine (scp, rsync, sftp) or ssh | Ask you. |
Sending mail directly (sendmail, mail, swaks, SMTP libraries) | gmail_send, which asks first. |
Raw connections (nc, socat, telnet, /dev/tcp) | An approved tool. |
In-code HTTP writes (requests.post, fetch with POST, axios.post, urllib, http.client) | An approved tool. |
The same rules apply to the script of a custom tool, both when it is saved and when it runs. The message the agent gets says what was refused and what to use. Reading pages and installing packages is fine.
Server fetches reach public addresses only
Browsing, the page reader, custom HTTP tools and approved web writes all fetch addresses that a model, a web page or a redirect might influence. Every such request is guarded.
- Only http and https, with no credentials in the URL, on port 80 or 443.
- The host must not be a private, loopback, link-local or reserved address, however it is written (decimal, hex, octal, IPv6, IPv4-mapped), and must not be a local-sounding name.
- Every address a name resolves to is checked: one private answer refuses it.
- Redirects are followed by hand, re-checking each hop, a bounded number of times.
- The body is read up to a limit, and the read stops there.
One honest limit: a name that changes its answer between the check and the connection (DNS rebinding) can slip past. The platform’s network keeps internal addresses unreachable from edge functions, and the check closes the common routes.
Secrets
- API keys for AI providers, payments, deploys and email live in server secrets, never in the browser.
- The browser only ever holds publishable keys, protected by row-level security.
- Connector tokens stay on the server. See How agent computers work.
- Custom HTTP tools send no headers, so a secret can never ride on one.