Restricting with bounds

This guide shows you how to start a session with less access than your identity normally has. A bound takes access away; it never grants any.

List the bounds on your machine:
Terminal
```
barry bound list
```
Start a session with the bound you want. For example, to deny shell commands, file writes, and outbound writes:
Terminal
```
barry --bound readonly
```

A bound named with --bound also asks the agent to deny its own shell and web tools, on adapters that support it. If you want read-only access to Barry’s tools but can accept the agent’s native shell staying available, barry -r is the shorter form: its bound restricts only the tools Barry serves.