Sandbox, data and retention

local for an agent whose data must stay on the node: it runs only on local/<model> models, and its judges, reviewers and best-of candidates stay on the node too (local models).

More paths below the session's working directory it may read but not write, besides .git/hooks, .git/config, .git/config.worktree, .git/commondir, .claude, .codex, .cursor, .vscode/tasks.json and .envrc, such as .idea or Makefile.

Paths of those defaults the agent may write, such as .claude for an agent that edits the Claude Code settings of the repository it works on.

The highest level (level, one of the tenant's) and the compartments (compartments; * for every one) of the tool results the agent's model may read; a result above it is withheld, and the model reads a notice instead (clearance per agent). The tenant's clearance for the agent replaces it. Unset means no limit. As a hand-off target, the agent's calls are held to the stricter of its clearance and that of the agent the job started on.

Hosts the agent's sessions may reach in sandbox tier 1, besides those its plugin, its harness's plugin and the tenant list, such as api.github.com or *.pypi.org, written as the allowlist entries of a plugin's egress; a !host entry denies a host whatever the other lists allow. Like a plugin's, they reach public addresses only: a host on the company's private network goes on the tenant's list. oz0 egress learn <job> proposes entries from what a run was refused. A host that serves files anyone can publish, such as raw.githubusercontent.com or a package registry, is a warning at plugin lint (OZ-S022).

true lets the processes of the agent's sandboxed sessions trace one another (ptrace, process_vm_readv, process_vm_writev), for gdb, strace, py-spy or a LeakSanitizer build. Off by default: tier 1's seccomp filter refuses those calls (what tier 1 blocks). It widens only the filter, for this agent's sessions and the executor of its remote sessions, never a harness's own sandbox. Such a session runs only on a node whose kernel.yama.ptrace_scope is 1 or more, which keeps tracing to a process's own descendants; oz0-node sandbox check says so on a node where it is not.

gvisor runs a harness agent's sessions, the terminals they open and its verify script under the node's own rootless runsc instead of bubblewrap, inside the node's limits, and never without it: the agent then requires isolation.gvisor-sandbox=ready (gVisor without Docker). Only for a harness: agent. sandbox takes no other key than these.

Keeps the agent's jobs at least this long, for records a law asks you to keep, such as bookkeeping: 30d, 12w or 7y (a year counts 366 days), from 1 day to 30 years, counted from each job's start.An erasure of a data subject defers the agent's jobs until their period ends and then erases them by itself; the tenant's retention and its Temporal histories keep them at least that long (keep what a law asks you to keep).A tenant's admins can override it per agent (oz0 retention keep-for). Unset keeps nothing beyond the tenant's retention. Lint refuses any other form. Which period applies to your records is yours to decide; the platform suggests none.

What the agent's jobs are for, by the tenant's purpose IDs, such as [support, quality]: lowercase letters, digits and . _ -, at most 64 characters each and 20 in all, no duplicates.A start that names a purpose (oz0 run --purpose, StartJobRequest.purpose, a routine's purpose, a channel binding's --purpose) must name one of these, or it is refused with the fix; a start that names none is allowed and counted.A flow declares purposes the same way, and its trigger.purpose names one of them for the jobs its webhook or events start. Which purposes exist and what legal basis each has are the tenant's own (purposes and legal bases).

Says the agent's jobs make or prepare decisions about the people they are about, such as scoring an application. Each such job started for a data subject gets a decision record when it closes: which inputs and steps it used (by digest), the agent's and runtime's versions, the models, the rules and approvals that applied, the outcome, and who took part by role. oz0 subject decisions lists a person's records, their bundle holds them, and oz0 subject contest records that the person disputes one (decision records). Default false.