Autonomy & Guardrails
Fine-tune agent privileges with kernel-level command interception, Hard-Lock destructive command blocking, and approval timeouts.
Granular Per-Tool Permissions
Autonomous agents should never operate with unchecked system access. Kernax enforces kernel-level command interception and granular privilege delegation directly inside your local environment:
| Tool Capability | Default Mode | Configurable Behavior |
|---|---|---|
| File Reads | Automatic (Always Allow) | Limited to workspace directory; system root access is strictly denied |
| File Writes & Edits | Interactive Review | Can be toggled to Auto-Apply for trusted workspaces |
| Terminal Commands | Confirmation Required | Intercepted by Hard-Lock Guard before shell subprocess spawns |
| MCP Tool Invocations | Per-Server Approval | Can be whitelisted per MCP server in .kernax/mcp.json |
Hard-Lock Destructive Command Guard
Hard-Lock Invariant: Kernax includes a hard-coded security heuristic running locally in Rust/C++. If an agent attempts to execute a destructive terminal pattern, the command is blocked instantly at the kernel layer, irrespective of autonomy settings.
Commands blocked by Hard-Lock include:
- Recursive deletions outside build artifacts (e.g.
rm -rf /,rm -rf ~,rm -rf ..). - Destructive database operations without transaction wrappers (e.g.
DROP DATABASE,DROP TABLE,TRUNCATE). - Forced git state mutations that overwrite history (e.g.
git push --force,git reset --hard origin/main). - Arbitrary remote binary downloads piped to shell (e.g.
curl | sh,wget | bash).
Approval Timeouts & Auto-Proceed
When running background Mission Control pipelines, you may configure how long the IDE waits for interactive confirmation before pausing or auto-proceeding:
settings.json
{
// Seconds to wait for developer approval on sensitive actions
"kernax.guardrails.approvalTimeoutSec": 45,
// Action on timeout: "pause" (recommended) or "cancel"
"kernax.guardrails.onTimeout": "pause",
// Require explicit confirmation for external network curl requests
"kernax.guardrails.confirmNetworkRequests": true
}Unattended Agent Safety
If you dispatch a 30-minute background refactoring pipeline and step away from your workstation:
- The agent operates inside an isolated sandbox git branch (
kernax/pipeline-*). - If an unapproved command or ambiguous condition arises, the pipeline halts gracefully and marks the step as Awaiting Review.
- No changes are merged into your primary branch until you inspect the diff and click Merge.
Was this page helpful?