Restricting with bounds

Use this when you want a session to run with less access than your identity normally has, such as a review session that must not write files.

A bound takes access away; it never grants any. A session with no bound has everything its traits grant.

Before you begin

• Build a Barry. These commands act as the bonanza identity from that guide; use your own identity’s command in its place.
• Know which traits your session starts with: a bound restricts what they grant.

Find a bound

1. List the bounds on your machine:

   Terminal

   barry bound list

   The output is similar to the following:

   Output

   Bounds:
   
     readonly
       Denies supported write tools, Bash, and recognized network writes; best effort, not a sandbox
   ...

Barry’s base identity defines readonly, no-secrets, no-network, no-network-write, and sandboxed-offline. None applies until a session or the identity asks for it.

Start a session under a bound

1. Start a session with the bound you want. For example, to deny shell commands, file writes, and outbound writes:

   Terminal

   bonanza session start --bound readonly

A bound also takes back the agent’s own native tools in the categories it restricts: readonly takes back native shell, file writes, and network tools. bonanza session start -r is the shorter form: it starts a session with every packed bag’s tools under the readonly bound and skips the trait picker.

Require a bound on every session

To make a bound apply to every session your identity starts, add it to the identity’s required bounds:

Terminal

bonanza identity bounds add no-secrets

bonanza identity bounds remove no-secrets takes it off again, and bonanza identity bounds clear removes every required bound.

Caution

Not every session mode can turn off every native tool. Cursor runs a few native tools it cannot turn off, and in Antigravity’s and Codex’s terminal modes, the person at the terminal can switch Barry’s gate off with /hooks. Check enforcement coverage for your harness and mode before you rely on a bound as a security boundary.

Verify

To confirm the identity’s required bounds, run:

Terminal

bonanza identity show

The Bounds: line lists the required bounds, such as no-secrets, and Optional bounds: lists the ones that apply only when a session asks for them.

To confirm a session’s bound, ask the agent in a readonly session to change a file:

Type in Barry

Create a file named notes.txt that says hello.

The agent cannot complete the request: the session has no write tools to call.

If it fails

• The session does not start and prints a list of bounds. The name you passed to --bound does not exist. Pick a name from barry bound list.
• The agent still wrote a file or ran a command. A harness’s own tools follow the session mode. See A bound did not stop the agent.

What’s next

• Manage secrets to pair the no-secrets bound with tool-scoped secrets.
• Bounds reference for every field a bound can set.
• Policy resolution for how traits and bounds combine into one policy.