agentstackMCP profile lease
Proves connection-local profile fencing, in-memory skill loads, freeze, and zero native artifacts.
Does not prove process isolation.Operating model · recommendation
Choose the boundary you actually need.
A profile lease is the recommended delivery primitive for MCP-capable interactive work. It is strongest when composed with integrity, consent, policy, and evidence—and dangerous when mistaken for isolation.
manifest + lockintent and reviewed bytes
trustlocal consent to auto-activate
profile leasesmallest live task surface
machine policyfloor no repo can loosen
auditevidence of brokered calls
Add lockdown when repository code or direct network access needs confinement. A lease narrows AgentStack's gateway; it does not sandbox arbitrary processes.
The primitives
One question per boundary
Keeping these responsibilities separate prevents the common category errors: a lock is not trust, trust is not policy, and audit is not enforcement.
Bundle
What intent is declared? agentstack.toml names servers, skills, profiles, and requested policy.
Does not certify referenced code as safe.
Integrity
Which capability bytes were reviewed? agentstack.lock pins resolved inputs; signatures can attest to the lock bytes.
Does not grant local consent to execute.
Selection
What does this task need? A profile names the intended server and skill set.
Does not decide how the harness receives it.
Delivery
How does selection reach the harness? Static render, native session, or MCP lease.
Does not confine the agent process.
Consent
May this repo auto-activate here? agentstack trust binds local approval to manifest + overlay + lock.
Does not mean “safe to run unsandboxed.”
Authority
Which tools, hosts, secrets, and paths are allowed? Machine and project policy intersect with deny precedence.
Does not create process isolation by itself.
Isolation
Where may the process run and connect? Sandbox and lockdown provide the runtime boundary.
Allowed destinations can still receive sensitive data.
Evidence
What happened? Call audit, run reports, and analysis record brokered activity and outcomes.
Recording is not prevention.
Decision table
Our recommendation—and the exceptions
| Situation | Use | Why |
|---|---|---|
| MCP-capable interactive work | Profile lease | Smallest live surface, no project-native cleanup, policy and audit remain on the path. |
| Native skills or instruction files | use --write | The harness reads those files itself; MCP cannot inject native files. |
| Native, but clean between sessions | session start/end | Temporary compatibility with an explicit restore contract. |
| Stable offline launches | Static render | No live gateway dependency; native config is ready at startup. |
| Unfamiliar repository | Trust gate first | Selection must never grant consent. Unreviewed auto-project bundles stay inert. |
| High-risk code or strict egress | Policy + lockdown | Policy defines authority; lockdown removes direct routes and confines the process. |
| CI | install --locked + doctor --ci | Checks reproducibility, policy, drift, and content without interactive trust. |
Examples by primitive
Run the proof that matches the claim
Trust + machine firewall
Proves an untrusted auto-project stays inert and machine policy can deny a repo-allowed tool.
Does not prove payload safety.Policy presets
Use the developer posture for daily work; compatible is a migration step, locked-down is for confinement, and CI is runner-only.
Policy is not a sandbox.Sandbox + lockdown
Proves destination restriction and runtime confinement when the proxy is the only network route.
Allowed destinations remain allowed.Audit + report
Shows brokered tool outcomes, denials, latency, and per-run egress decisions without argument or secret values.
Evidence is not prevention.CI verification
Proves lock drift, policy, and unsafe content can fail a pipeline deterministically.
CI does not grant runtime consent.Lease edge case
Trust can fail closed without erasing the proposal trail
If manifest or lock bytes change during an auto-project connection, AgentStack replaces the live gateway with an empty one. The in-memory lease may remain inspectable, and agentstack_lease_freeze may still propose a manifest profile because it serves no bundle content, resolves no secrets, spawns no server, and applies no files. Restoring an active gateway still requires review, locking where needed, and renewed trust.
Apply the model
See every primitive in context.
Use the examples to move from declaration through selection, consent, enforcement, isolation, and evidence without overstating any boundary.