What a step can reach
A step is meant to work in its worktree and the run's own folders under [`data_dir`](../config.md). With [`sandbox.mode`](../config.md) off (the default), the process still runs with your user's permissions: it can read, write, and open network connections as you can.
A step is meant to work in its worktree and the run's own folders under data_dir. With sandbox.mode off (the default), the process still runs with your user's permissions: it can read, write, and open network connections as you can.
When an attempt's effective sandbox is required, the factory wraps the step process in an OS-native sandbox (Seatbelt on macOS, Bubblewrap on Linux and WSL2). Inside it a step can write only its worktrees, needed git folders, artifacts, and a private temp folder. The real home, keys, other repos, the secret store, and the signing agent are not visible. The network stays open, including the host's localhost.
Detail: OS sandbox (what it protects, what it doesn't, and macOS login tokens).
Environment allowlist
Only environment names on the allowlist are passed into a step. The list is the built-in default, plus access.env.allow, plus that step's env_allow. Claude Code steps also receive claude.env_passthrough. The allowlist does not stop a process from reading a secret out of a file. Sandboxed attempts also set TMPDIR, XDG_CACHE_HOME, XDG_RUNTIME_DIR, and KUSAW_SANDBOX.
Effect appliers (GF-91)
Command effect kinds run in the factory folder, not in a worktree and not in a step sandbox. Secrets declared on effects.<kind>.env reach only that applier process. They are not in the step request, the agent session environment, or the agent's tools. Applier stdin and stdout are in Effect applier.
Redaction
access.redact.patterns are stripped from logs, events, and artifacts. The factory also redacts values from the serve process whose names look like secrets. Redaction does not apply to what an agent step sends to the Claude Code you configured.
What stays local and what doesn't
The factory's own files stay on the machine that runs it. What an agent step reads can leave, because that step calls the model provider you configured. Telemetry stays off until you turn it on.
What needs your approval
The factory does not merge, does not push, and does not apply self-improvement proposals on its own. You approve gates you put in the pipeline. You merge and push the local commit it left. You can stop a run, or every run in a factory, from the machine that is serving it.