Govern what your agents can reach

This is the Govern pillar in one guide — the guarantees that let you hand an agent real access without handing it the keys to everything.

Giving an agent a shell and live connections is only safe if you can bound what it reaches, see what it did, and stop it before it costs too much. connect0 enforces all three at runtime — not as a checklist, but as behaviour the core will not let an agent step around.

1. Scoped access — agents are default-closed

An agent starts with no access. It can only reach a connection that was explicitly granted to it. And critically, that grant is checked on the path agents actually use: the MCP connector tools.

When an agent calls connector.refresh on a connection-backed connector, the core runs an ACL check (requireResourceAccess, action use) before it materialises anything. If the agent wasn't granted that connection, the refresh fails — the agent never sees the data. Because agents act primarily through MCP, closing this exact path is what makes "default-closed" a real guarantee rather than a setting an agent could talk around.

The practical shape: two agents on the same account, each granted only its own connections, can never read each other's — even though both speak the same MCP surface.

2. Audit — every action is logged

There is no silent action. connector.add, connector.refresh, and connector.remove each write an audit row. Every sh invocation is logged too — the command, its exit code, and its duration are recorded on the way through, so the workspace half is reconstructable without ever re-running the sandbox.

That gives you an answer to "what did this agent actually do, and when?" that doesn't depend on trusting the agent's own account of itself. Stdout and stderr are deliberately never persisted — too easy to capture a secret someone typed — but the fact and shape of every action is.

3. Budget caps — a run stops before it overspends

Access and audit bound what and whether; caps bound how much. Each account carries a spend cap, and it's enforced on the hot path. Before an sh command executes, the core checks current spend against the cap. Over the cap, the call is refused with the current spend, the cap, and a link to raise it — the run stops rather than quietly running up a bill.

Because the check sits in front of the sandbox exec, a runaway agent can't burn through your budget one command at a time: the cap catches it at the next call.

The shape of it

• Scoped: default-closed; ACL enforced on the MCP connector path, so an agent reaches only what it was granted.
• Audited: every connector and sh action logged, with secrets kept out of the log.
• Capped: per-account spend caps refuse work over the limit at execution time.

Together these are what let you point an agent at production connections without pointing it at everything — each project is an isolated workspace, and each agent an isolated, bounded principal inside it.

Where this fits

This is the Govern your agents pillar of connect0 — the core that connects everything your company runs on. Scoped access, a full audit trail, and hard spend caps are what turn "an agent with a shell and live data" from a liability into something you can actually run in production. Start building → · All guides →