Supervised runs

Start workstation agents through Sentinel so they run in a sandbox with credential and network protections, and decide what happens to agents started any other way.

Requires the privileged service

Supervision runs in the privileged service. Configure it under Policy → Supervision.

Runs

A run is one supervised agent process tree. Every running agent on a device is reported as one of three states.

State	How it started	What it gets
Launched	Through the Sentinel launcher.	Sandbox, attribution, capture, routing, and process telemetry.
Adopted	Any other way, then picked up by Sentinel.	Attribution, capture, routing, and process telemetry. No sandbox.
Unsupervised	Running outside any run.	Nothing beyond what the network guard applies to all processes.

Launched runs

Sentinel installs launcher shims so that claude, codex, gemini, opencode, pi, hal, and aider start through it. You can also launch a harness explicitly:

bash

exo-sentinel exec -- claude

The service grants a run only to its own installed binary, so a patched copy cannot skip the sandbox. It contains the process tree, then hands back the sandbox and the run environment: gateway key and URL where routing is on, the device CA, and a per-run proxy identity where there is no transparent redirection, so the run's traffic is captured and attributed. If the service is not running, launching is refused.

On Linux the shims sit first in PATH. On macOS they come after system directories.

The sandbox

A launched run can write only to its workspace, agent state directories, temporary directories, and paths your policy adds.

Platform	Mechanism	Also blocked
macOS	Seatbelt	Opening other applications, launchctl, AppleScript, Automator, Shortcuts, and Apple Events, so a run cannot drive Terminal or Finder to work outside it.
Linux	Landlock plus a seccomp filter	Tracing other processes, mounts and namespaces, kernel modules, and injecting input into the user's terminal. Debuggers such as strace and gdb do not work inside a run.
Windows	A write-restricted token, or an AppContainer when credential or network protection is on	Pending qualification on real Windows devices.

Supervision options

These are off by default.

Option	Effect
Denied executables	Programs a run may not start.
Protect credentials	The run can neither read nor write SSH private keys, cloud and Kubernetes credentials (`~/.aws`, `~/.azure`, `~/.kube`), GitHub and 1Password CLI configuration, GnuPG and password stores, Docker and `.netrc` credentials, git credentials, and browser profiles and cookies. `known_hosts` and ssh-agent keep working.
Protected paths	Additional paths a run cannot read or write. Applies with or without Protect credentials.
Network only through the guard	Outbound connections only to loopback, DNS, and ports you list as direct. Every connection is attributed, judged by network policy, and recorded. Tools that ignore proxy settings lose network access.
Blocked launch directories	The service refuses to start a run whose working directory is in or beneath one.

Refused, not weakened

Where a platform cannot enforce an option you turned on, a run that needs it is refused instead of started without it.

A broad protected path such as your home directory still leaves readable what a run needs to work: system libraries, managed harness settings, the device CA, and the harness's own install directory. Writable paths beneath a protected path stay usable, because the more specific path wins.

Adopted runs

Agents and editors started from the Dock, a desktop launcher, or a plain shell are adopted within about 10 seconds. Adopting a process that is already running does not add a sandbox to it. For editors, the device also reports whether the Sentinel IDE extension is connected.

Require the Sentinel launcher

Require the Sentinel launcher, on the Sandbox tab, makes agents run through the launcher. With it on:

Agents started any other way are terminated. This covers Claude Code, Codex, Gemini CLI, OpenCode, aider, and goose, unless listed as allowed applications. The console lists them as terminated. Editors such as VS Code, Cursor, and Windsurf keep running; their AI traffic is refused unless the vendor is exempted under gateway routing.
No gateway key is issued to a process outside a launched run.
No AI connection from outside a launched run, when Allowed applications is also on.

Enable it last

Turn this on only after the launcher works on every device. Sessions already running outside Sentinel are terminated within about 10 seconds.