AI agents at work: deployment with restricted access

Define what the agent can reach

An agent that reads documents and runs commands also loads third-party dependencies. A flaw or a compromised package can use the access granted to that process. Before connecting the tool to company systems, define the files, services and operations it needs.

Assessment identifies exposed data, credentials, integrations and external effects. The proposal must distinguish a pilot with dedicated files from an operation that writes to real systems. An on-screen confirmation does not replace a limit enforced outside the model.

Isolate installation, interface and execution

For a local Hermes installation on Linux, I prepared the interface build in Docker. The agent received another container with a dedicated volume and no general network. The official interface ran in Bubblewrap with a separate home directory. A Weston compositor provided the window without sharing the session's X11 access with the app.

The app had no access to the real personal home, Docker socket or user SSH, GPG and D-Bus services. Microphone, screen capture and other integrations were reduced. This scope permits a start with less access. A required integration can follow with specific permission and a new check.

Control access to models

The agent's external access was restricted to a channel with a fixed Rota Nacional destination. The application credential must belong to its organization. The provider secret does not need to stay in the agent. Network restrictions, key authorization and service limits address different parts of the risk.

The API contract matters. RN's native API preserves original content. Protected chat applies the privacy barrier according to policy and coverage. If the organization requires the barrier, native access is refused. Assessment must check tools, streaming and transmitted data before choosing a path.

Require checks that match the delivery

In the local check on 4 November 2026, all 21 isolation checks passed. They covered inaccessible files and services, the agent user, blocked network access, authorized TLS and channel authentication. The interface opened and its settings worked. The check did not include a model response because a dedicated key had not been registered.

For a company, acceptance must include the useful workflow with synthetic data, access refusals and recovery after interruption. A tool that sends messages or changes records needs checks for authorization and repeated actions. A successful build or running container does not prove that result.

Commission assessment, deployment or ongoing work

Assessment can deliver an access map and a deployment plan. Deployment can include isolation profiles, controlled builds, restricted credentials, RN configuration, refusal tests and a recovery procedure. Ongoing work can review updates, permissions, usage and failures. The contract defines owners, coverage and acceptance criteria.

Docker and Bubblewrap share the Linux kernel. The agent can still change the data and use the key it receives. Higher risks can require a virtual machine or a separate computer. The proposal must record these limits and the integrations outside its scope.

Read the technical procedures

• Agent in Docker: files, privileges and resources
• Bubblewrap interface with a Weston window
• Isolated builds and dependencies
• Restricted network and the RN contract