OpenShell explained: where an AI agent is allowed to act
OpenShell security operations: policy provenance and credential paths
Verify the selected policy and the runtime fence before trusting an agent workload
What you will learn
- Inspect the effective policy
- Keep credentials out of the workload
- Decide telemetry and response steps
Before you start
- One disposable workload and a supported compute runtime
- Authority to inspect policy and provider configuration
Turn the documented controls into a small reviewable operational report
Key takeaways
- An omitted policy flag does not prove a restrictive effective policy.
- Credential injection needs endpoint and method review.
- Sandboxing limits capability but not task intent.
Inspect the effective policy
The default policy denies outbound access only when no global, saved or image policy takes precedence. Attached providers may also add network rules. Compare base and effective views and keep their revisions with each test.
The default-policy document lists filesystem baseline paths added when network rules exist. Runtime-only CA and GPU paths may appear in neither policy view. Test what a running sandbox enforces; omitting `--policy` does not reveal the full grant set.
Keep credentials out of the workload
Providers associate service names with stored credentials; the supervisor attaches them to approved requests. Review endpoint, method and binary restrictions, rotate a credential after a test and confirm access disappears.
Prompt injection can still steer an agent toward actions inside its granted scope. Restrict the scope, use synthetic data, and review denied requests. Isolation cannot decide whether the user actually wanted an allowed action.
Decide telemetry and response steps
The README says operational counts are collected by default and names `OPENSHELL_TELEMETRY_ENABLED=false` as a disable switch. Check the telemetry document and your deployment settings before putting sensitive workflows through the gateway.
Keep logs, policy changes, sandbox images and provider approvals in an incident record. This review has not attacked the boundary and does not certify the software for a regulated environment.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Save the base and effective policy before agent launch.
- 2
Test provider revocation and denied direct egress.
- 3
Set telemetry and incident-retention choices explicitly.
Copy-ready example
review:
base_policy: record-revision
effective_policy: record-revision
direct_egress: denied-in-test
provider_revocation: verified
telemetry: explicit-settingFrequently asked questions
Are provider keys stored inside the agent container?
The pinned design says they stay with the trusted supervisor and are added to approved outbound requests.
Is telemetry necessarily off?
No. The README describes anonymous operational telemetry and an explicit disable setting.
Sources
- OpenShell / docs/how-it-works/policies/default-policy.mdxSource checked 2026-10-04
- OpenShell / docs/how-it-works/providers/overview.mdxSource checked 2026-10-04
- OpenShell / docs/observability/telemetry.mdxSource checked 2026-10-04
- OpenShell / docs/about/architecture.mdxSource checked 2026-10-04