Network rules (network_policies)
Filesystem (Landlock, fixed at start)
✓/workspaceread and write: the project
✓/usr, /etcread only
✗~/.ssh, everything elsenot listed, so denied
What you are looking at: an AI coding agent inside an OpenShell sandbox. On the left is its policy: everything not listed is denied. Pick an action the agent tries, and follow it through the sandbox, the supervisor and out to the internet, or not.
Try this: fire "Upload SSH keys", the classic prompt-injection attack, and see two separate layers stop it. Then fire "Read a repo" and watch the token placeholder become a real token only after the check passes. Finally switch GitHub to read-write and fire "Open an issue" again.
What you are looking at: when a request is blocked, an agent can propose the network rule it needs. Every proposal goes through OpenShell's policy prover, which flags risky new access. Proposals with any finding always wait for a person; with auto-approve on, clean ones go straight through.
Try this: turn auto-approve on and see which proposals still stop for review, and why. Approving a proposal adds a live rule without restarting the sandbox.
Proposals can only add network rules. They can never remove rules or touch filesystem and process settings.
This is a teaching simulation in your browser, not a running OpenShell. Rule names, decisions and prover findings follow OpenShell's documentation (deny by default, per-binary rules, REST read-only access, credential substitution at allowed endpoints, risk checks for credentialed reach, cloud metadata, wildcard hosts and new HTTP methods). Hosts and tokens are made up.