Blueprint AgentProfiles and Policies

Profiles and Policies

Profiles configure how an agent runs. They package model choice, tool access, permissions, guardrails, and harness selection into a reusable sidecar profile that the runtime enforces. This is how the workbench configures agent execution without hard-coding behavior into every task.

What A Profile Controls

  • Harness selection: OpenCode, Claude Code, Kimi Code, Codex, AMP, Factory Droids, Pi, Hermes, Forge, OpenClaw, NanoClaw, ACP, Cursor, or CLI base when the product exposes them. The Sandbox session picker currently offers OpenCode, Claude Code, Codex, Kimi Code, OpenClaw, NanoClaw, and Hermes; the remaining backends are SDK-only.
  • Model selection: primary and small model routing per profile.
  • Per-agent tuning: distinct configs for plan/build/explore (prompt, temperature, max steps).
  • Tool access: enable or disable individual tools.
  • Permissions: edit, bash, web access, and tool-server access (ask/allow/deny).
  • Command scoping: bash can be limited by command allowlists.
  • Tool servers: allowlisted local or remote servers with headers, env, and timeouts.
  • Plugins: allowlisted extensions that can be attached to the runtime.
  • Inheritance: extend a base profile and override only what changes.

Guardrails And Validation

Profiles are validated before execution. Security policies can cap permissions (for example, “bash” at ask), block local tool servers, and require allowlisted plugins. Profiles that exceed policy are rejected so the runtime stays safe and predictable.

Base, Variant, and Per-Run Profiles

The workbench exposes profile controls today:

  • Base profiles for org-wide defaults, inherited with extends.
  • Custom profiles for team or project overrides, created and edited from the profile selector in the chat composer.
  • Per-run selection: pick the profile a session runs under before each run.

The runtime merges overrides with the base profile, validates the final config, and applies the result to the sidecar session.

Example Profile (Conceptual)

{
  "name": "team-default",
  "extends": "tangle/base",
  "model": "provider/model-id",
  "small_model": "provider/model-small",
  "agent": {
    "plan": { "temperature": 0.2, "maxSteps": 8 },
    "build": { "temperature": 0.1, "tools": { "git": true, "bash": false } },
    "explore": { "temperature": 0.7 }
  },
  "permission": {
    "edit": "ask",
    "bash": "ask",
    "webfetch": "allow",
    "mcp": "ask"
  },
  "tools": {
    "git": true,
    "search": true,
    "bash": false
  },
  "mcp": {
    "internal-search": {
      "type": "remote",
      "url": "https://tools.example.com/mcp",
      "timeout": 10000
    }
  }
}

For a field-by-field reference, see Profile Schema. The schema is harness-aware; each backend maps the shared profile fields to its own config surface. See Sandbox Harnesses for the centralized sandbox list and the smaller AI Agent Sandbox blueprint sidecar list.

SimulationsProfile Schema