docker-agent/examples/safety_modes.yaml at main · docker/docker-agent · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
# Safety modes can be declared right in the agent YAML:
#   runtime.safety        — config-wide default for new sessions
#   agents.<name>.safety  — per-agent override of the config default
#
# Only strict, balanced, restricted, and autonomous are accepted. These
# are DEFAULTS only; precedence (highest first) when a new root session
# starts:
#
#   --safety flag > --yolo flag > alias safety/yolo option >
#   settings.safety/YOLO (user config) > agents.<name>.safety >
#   runtime.safety > built-in default (read-only tools auto-approve,
#   everything else asks)
#
# A resumed session keeps its stored mode unless an explicit --safety or
# --yolo flag is passed. Trust warning: YAML defaults come from the agent
# author — a config pulled from a URL or OCI registry can declare
# `autonomous`, so review third-party configs before running them; your
# own settings, alias options, and CLI flags always win over them.
runtime:
  safety: balanced

agents:
  root:
    model: anthropic/claude-haiku-4-5
    description: Shell agent demonstrating the safety modes
    welcome_message: |
      Every shell command is classified (safe / destructive / unknown)
      and gated by the session's safety mode:

        strict      — ask for every tool call
        balanced    — safe commands run silently; destructive and
                      unknown commands ask
        restricted  — safe commands run silently; destructive and
                      unknown commands are denied without asking
                      (fail-closed, for unattended runs)
        autonomous  — everything runs (legacy --yolo); only custom
                      deny/ask rules still gate

      This config declares `runtime.safety: balanced`, so fresh sessions
      start balanced unless you choose otherwise (`--safety`, `--yolo`,
      an alias option, or `settings.safety` in your user config). The
      `auditor` agent overrides the config default with `safety: strict`,
      and `ci` with `safety: restricted`. You can still escalate from a
      confirmation prompt ([B] balanced, [A] autonomous). Custom
      permissions rules (see permissions.yaml) always win over the mode.
    instruction: Use the shell tool to run the command the user asks for.
    toolsets:
      - type: shell

  # Per-agent override: `docker-agent run safety_modes.yaml -a auditor`
  # starts strict even though the config-wide default is balanced.
  auditor:
    model: anthropic/claude-haiku-4-5
    description: Read-oriented agent that asks before every tool call
    safety: strict
    instruction: >
      Inspect the system with the shell tool. Prefer read-only commands
      and explain what each command does before running it.
    toolsets:
      - type: shell

  # Fail-closed default for unattended runs: safe commands run, anything
  # destructive or unknown is denied without prompting. Pair with an
  # `allow:` permissions list for the commands the job actually needs
  # (explicit rules win over the mode). Defense in depth, not isolation —
  # use --sandbox for a real security boundary.
  ci:
    model: anthropic/claude-haiku-4-5
    description: Headless agent that denies unmatched calls instead of prompting (restricted mode)
    safety: restricted
    instruction: >
      Run the checks the user asks for with the shell tool. If a command
      is denied, report it instead of working around the denial.
    toolsets:
      - type: shell