--- title: "Sandbox, data and retention" description: "Agent definition fields for sandbox, data and retention." canonical_url: "https://docs.oz0.ai/reference/agent-definition/security" --- # Sandbox, data and retention > Agent definition fields for sandbox, data and retention. For: Plugin authors looking up agent fields. Look up the fields below when editing an agent definition. `local` for an agent whose data must stay on the node: it runs only on `local/` models, and its judges, reviewers and best-of candidates stay on the node too ([local models](https://docs.oz0.ai/fleet/local-models)). More paths below the session's working directory it may read but not write, besides `.git/hooks`, `.git/config`, `.git/config.worktree`, `.git/commondir`, `.claude`, `.codex`, `.cursor`, `.vscode/tasks.json` and `.envrc`, such as `.idea` or `Makefile`. Paths of those defaults the agent may write, such as `.claude` for an agent that edits the Claude Code settings of the repository it works on. The highest level (`level`, one of the tenant's) and the compartments (`compartments`; `*` for every one) of the tool results the agent's model may read; a result above it is withheld, and the model reads a notice instead ([clearance per agent](https://docs.oz0.ai/govern/taint-and-labels/label-policies#clearance-per-agent)). The tenant's clearance for the agent replaces it. Unset means no limit. As a hand-off target, the agent's calls are held to the stricter of its clearance and that of the agent the job started on. Hosts the agent's sessions may reach in [sandbox tier 1](https://docs.oz0.ai/concepts/security/sandbox-tiers#sandboxes), besides those its plugin, its harness's plugin and the tenant list, such as `api.github.com` or `*.pypi.org`, written as the [allowlist entries](https://docs.oz0.ai/concepts/security/sandbox-tiers#sandboxes) of a plugin's `egress`; a `!host` entry denies a host whatever the other lists allow. Like a plugin's, they reach public addresses only: a host on the company's private network goes on the tenant's list. `oz0 egress learn ` proposes entries from what a run was refused. A host that serves files anyone can publish, such as `raw.githubusercontent.com` or a package registry, is a warning at `plugin lint` ([OZ-S022](https://docs.oz0.ai/build/plugins/structure/lint-rules#oz-s022)). `true` lets the processes of the agent's sandboxed sessions trace one another (`ptrace`, `process_vm_readv`, `process_vm_writev`), for gdb, strace, py-spy or a LeakSanitizer build. Off by default: tier 1's seccomp filter refuses those calls ([what tier 1 blocks](https://docs.oz0.ai/concepts/security/sandbox-tiers#what-tier-1-blocks)). It widens only the filter, for this agent's sessions and the executor of its remote sessions, never a harness's own sandbox. Such a session runs only on a node whose `kernel.yama.ptrace_scope` is 1 or more, which keeps tracing to a process's own descendants; `oz0-node sandbox check` says so on a node where it is not. `gvisor` runs a harness agent's sessions, the terminals they open and its verify script under the node's own rootless runsc instead of bubblewrap, inside the node's limits, and never without it: the agent then requires `isolation.gvisor-sandbox=ready` ([gVisor without Docker](https://docs.oz0.ai/fleet/sandbox-tier-2/gvisor#gvisor-without-docker)). Only for a `harness:` agent. `sandbox` takes no other key than these. Keeps the agent's jobs at least this long, for records a law asks you to keep, such as bookkeeping: `30d`, `12w` or `7y` (a year counts 366 days), from 1 day to 30 years, counted from each job's start. An erasure of a data subject defers the agent's jobs until their period ends and then erases them by itself; the tenant's retention and its Temporal histories keep them at least that long ([keep what a law asks you to keep](https://docs.oz0.ai/govern/personal-data/retention#keep-what-a-law-asks-you-to-keep)). A tenant's admins can override it per agent (`oz0 retention keep-for`). Unset keeps nothing beyond the tenant's retention. Lint refuses any other form. Which period applies to your records is yours to decide; the platform suggests none. What the agent's jobs are for, by the tenant's purpose IDs, such as `[support, quality]`: lowercase letters, digits and `. _ -`, at most 64 characters each and 20 in all, no duplicates. A start that names a purpose (`oz0 run --purpose`, `StartJobRequest.purpose`, a routine's `purpose`, a channel binding's `--purpose`) must name one of these, or it is refused with the fix; a start that names none is allowed and counted. A flow declares `purposes` the same way, and its `trigger.purpose` names one of them for the jobs its webhook or events start. Which purposes exist and what legal basis each has are the tenant's own ([purposes and legal bases](https://docs.oz0.ai/govern/personal-data/associate-people#purposes-and-legal-bases)). Says the agent's jobs make or prepare decisions about the people they are about, such as scoring an application. Each such job started for a data subject gets a decision record when it closes: which inputs and steps it used (by digest), the agent's and runtime's versions, the models, the rules and approvals that applied, the outcome, and who took part by role. `oz0 subject decisions` lists a person's records, their bundle holds them, and `oz0 subject contest` records that the person disputes one ([decision records](https://docs.oz0.ai/govern/personal-data/restrictions-and-contests#decision-records-and-contests)). Default `false`. [Back to the agent definition](https://docs.oz0.ai/reference/agent-definition). ## Sitemap See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.