Is there any way to manage permission for different agents/subagents in opencode?

[pritam-dey3]

Thanks for all the wonderful project! I have been looking for such a capability and thanks for bringing this to life.

When I work on opencode, I generally enforce different permissions for different agents. For e.g. the planning agent does not get edit access anywhere except for 'explore' directory. Investigator agent does not get access to edit 'tests' directory and so on.

Is it possible to maintain different policies for different agents? Because I didn't see such an option in policies documentation.

[johntmyers]

You can enforce different policies for sandboxes, which would impact the agents running within those sandboxes.

[pritam-dey3]

Thanks for responding. I explored a little more, The policies documentation says

A policy has static sections filesystem_policy, landlock, and process that are locked at sandbox creation, and a dynamic section network_policies that is hot-reloadable on a running sandbox.

So while I am running opencode inside openshell, if I change my agent from Build to Investigate, the file system policies are going to remain same. Even more, if my Build agent calls some sub agent Explore which should not have certain permission like editing any files, they are not going to get applied because the file system policies are locked in.

Let me know if I am missing something.

My goal is to have agent/subagent level policies for opencode. Is there any way I can have different sanbox assigned to different agents? Any guidance is welcome.

Thanks again for your time!