← All posts
By The agentjail team
announcementreleaseruntime grantssecurity

v1.7.0: Bounded authority, visible to the agent

agentjail v1.7.0 guides agents to governed host access, adds exact session-bound grant foundations, and fixes Codex 0.150.1 approval loops.

A coding agent request passing through AgentJail policy into an exact session-bound grant, with mismatched requests denied.

A sandbox can block the wrong path. It also needs to make the right path easy to find.

AgentJail already had a native, one-use host proxy for commands that genuinely need access outside the sandbox. The missing piece was discovery. A Claude Code or Codex session could hit a file boundary without knowing that the governed path existed.

v1.7.0 closes that gap. It also lands the typed lifecycle that future runtime capabilities will share, and fixes an approval loop introduced by Codex 0.150.1.

TL;DR

  • Claude Code and Codex now learn the governed host-access path. AgentJail owns one fenced block in each installed agent’s global instruction file.
  • MCP and credentials do not take a shortcut. The guidance tells agents to use those tools normally so their existing policy and approval flows remain in control.
  • Runtime authority has an exact lifecycle. Grants bind the principal, session, action, resource, policy epoch, scope, expiry, and activation state.
  • Codex 0.150.1 command approval works again. The repeated broker callback no longer invalidates the challenge it is trying to redeem.
  • Production MCP connector forwarding still fails closed. The release does not pretend that configuration alone is a safe data plane.

The agent can find the safe path

For an installed Claude Code or Codex integration, AgentJail adds one marked block to the agent’s global instructions:

direct host file or CLI access
    -> consult agentjail proxy --help
    -> request native human approval
    -> run one exact command outside the shield

MCP or credential access
    -> use the normal tool
    -> existing AgentJail policy and approval flow

This is guidance, not enforcement. The coding-agent hook, command policy, credential controls, network policy, and OS sandbox still decide what can run. The instruction block does not grant authority and cannot override a deny.

Install and update refresh only the bytes inside AgentJail’s markers. Existing instructions, file modes, and instruction-file symlinks are preserved. Uninstall removes only AgentJail-owned content. If the markers are malformed or cleanup cannot complete, uninstall names the path and returns a failure instead of printing a misleading success message.

One lifecycle for bounded authority

v1.7.0 introduces a typed runtime-grant domain for commands, files, network access, MCP calls, and credentials. A grant is not a loose boolean. It records:

  • the requesting agent, principal, and session
  • the exact action, canonical resource, and arguments
  • the policy epoch under which approval happened
  • one-use, session, or bounded-TTL scope
  • approval, activation, consumption, expiry, and revocation state

Approval and activation are intentionally separate. Approval says an operation may happen. Activation proves the required enforcement and transport are ready before that authority becomes usable.

Explicit and locked policy denies keep precedence. A runtime grant can satisfy an eligible ask; it cannot turn a deny into an allow.

Host connectors stop at the honest boundary

Trusted global policy can now describe typed host connectors, including a loopback Chrome CDP connector with a fixed readiness probe. Project overlays cannot add them, and invalid, duplicate, non-loopback, symlinked, incorrectly owned, or incorrectly permissioned endpoints are rejected.

agentjail doctor reports the layers separately: grant support, authorization, activation, transport, and upstream capability. It does not print destinations, capabilities, or approval evidence.

This release does not expose production MCP connector forwarding. Current Codex does not provide the required native MCP approval receipt, and the forwarding path cannot yet bind route lifetime to one-use, TTL, and revocation state. That combination stays unavailable and fails closed.

Codex 0.150.1 approval loops are fixed

Codex 0.150.1 sends AgentJail’s rewritten command broker through PreToolUse a second time. Older integration behavior treated that callback as a brand-new tool call, advanced the session epoch, invalidated the pending challenge, and sent Codex back to the original command. The result was an approval loop.

AgentJail now recognizes only an exact pending broker transport with the same operation, session, turn, working directory, and verified Codex process. That callback does not advance the original epoch. Unknown, stale, already observed, malformed, or mismatched broker invocations still deny before execution.

Upgrade

Upgrade through the same channel you installed from:

brew upgrade agentjail
# or
agentjail update

Then verify the installed release and integration state:

agentjail version
agentjail doctor

If you want to reconcile every detected coding-agent integration explicitly:

agentjail install --all

Full changelog. Source and release artifacts.