Permission bands for AI agents

Deny-by-default security for agent execution. Define what your agents can and cannot do with simple, composable band files.

Get Started Learn More

allow: Bash(git *) deny: Bash(rm -rf *) insist: Read(CLAUDE.md) max_turns: 10 env: API_KEY contract: json_schema

      BAND.md
---
name: deploy-bot
description: Deploys services with guardrails
version: 1
execution_target: lima

allow:
  Bash:
    - git pull
    - docker build *
    - docker push *
  Read:
    - Dockerfile
    - docker-compose.yml

deny:
  Bash:
    - rm -rf *
    - curl *

limits:
  max_turns: 20
  max_tokens: 50000
---

# Deploy Bot
You are a deployment assistant. Follow the runbook exactly.
    

Why bands?

Agents are powerful but unpredictable. Bands give you fine-grained control over what they can access, enforce, and produce.

Deny by Default

Nothing is allowed unless explicitly granted. Agents start with zero permissions and build up from there.

✓

Allow, Deny, Insist

Three permission modes give you precise control. Allow specific tools, deny dangerous patterns, insist on required behaviors.

○

Composable

Stack multiple bands together. Permissions compose with clear precedence rules. Deny always wins over allow.

□

Sandboxed Execution

Run agents in isolated environments. Lima VMs for macOS, Cloudflare Workers for V8 isolates, or local with full access.

△

Resource Limits

Cap turns, tokens, and tool calls. Prevent runaway agents with hard limits that terminate execution.

◇

Output Contracts

Define JSON schemas for agent output. Enforce structured responses so downstream systems can rely on the shape of the data.

How it works

From band file to sandboxed execution in three steps.

Write a band

Create a BAND.md file with YAML frontmatter defining permissions, limits, and execution target. The markdown body becomes the agent's system prompt.

Run your agent

The bands runtime loads your band, applies permissions, and launches the agent in the specified execution environment with enforced constraints.

Get structured output

The agent runs within its permission boundaries. Output is validated against contracts. Limits are enforced. No surprises.

Execution targets

Choose the right isolation level for your use case.

⚠

local-dangerously

Full access to your local machine. Use only for trusted agents or development. No sandboxing.

▣

lima

Lightweight Linux VMs on macOS. File system isolation with shared directories. Good balance of security and capability.

☁

cloudflare (coming soon)

Dynamic Workers for on-demand V8 isolates. Maximum isolation for untrusted code. Fast cold starts, no file system access.