memi-design Approval Sandbox Policies
Define approval, sandbox, filesystem, and command policy for local autonomous agents.
When to Use
Use this Note when a Memoire or Studio run needs agent approvals, sandbox mode, command allowlist, secure agent run.
Workflow
- Classify every run as read-only, workspace-write, or full-access before launching an agent.
- Bind filesystem writes to the project root unless the task explicitly requires external paths.
- Allowlist narrow commands by absolute path or stable prefix, not broad shell access.
- Require approval for network, package install, credential, desktop automation, and deletion steps.
- Store the final policy next to the session transcript so future agents inherit the boundary.