Settings & Policy

Settings determine the operating envelope around an agentAgentA worker you delegate to: brief it, and it takes steps on its own. A chatbot answers; an agent acts.An LLM that runs tools in a loop toward a goal — it acts, checks the result, decides the next step, and repeats until done.Full definitionClose: model selection, sandboxing, approvals, permissions, extension discovery, environment, and managed policy. Product schemas differ, but the architecture problem is stable.

Separate Five Concerns

1. Behavioral guidance — what the agent should do; belongs in project instructions.
2. Capability configuration — which tools, servers, skills, and agents are available.
3. Authorization — which actions are allowed, denied, or require approval.
4. Execution isolation — what the process can actually read, write, execute, and reach.
5. Organization policy — centrally controlled constraints users cannot weaken locally.

Collapsing these into one settings file creates false assurance. A denied tool pattern may not constrain a different execution path. A sandbox may limit the process but not an MCPMCPUSB-C for AI — one standard plug so any agent can connect to any data source or tool.The Model Context Protocol: an open standard (Anthropic, 2024) for connecting AI systems to external tools and data without building a custom integration for each one.Full definitionClose server using separate credentials. A managed product setting does not replace repository CI.

Precedence Is Part of Correctness

User, repository, local, command-line, environment, and managed scopes can merge or override in different orders. Record the resolved configuration used for consequential runs. Test that a lower-trust repository cannot override a higher-trust policy source.

Portability Strategy

Maintain a vendor-neutral policy statement and translate it into product-specific settings adapters. Verify each adapter with negative tests: denied reads, denied writes, external network access, destructive commands, nested agents, MCP actions, and cloud execution.

The deeper lenses retain Claude Code settings examples. Use them to reason about layering and permission architecture, not as Codex or Copilot syntax.