Path control

Filesystem boundaries for IDE coding agents. Constrain which paths agents can read or write. Keep work inside the repo; keep secrets and infra out of reach.

Part of Control rules with bash, MCP, and prompt. Pattern detection across sessions: Behavior Guards.

Why it matters

Agents that can touch .env, SSH keys, or production kube configs turn a coding session into a credential incident. Path rules belong in the execution path, not in chat tips.

How it works

When an agent proposes a path read or write, Relay evaluates path rules before the filesystem side effect.

Denied calls return a structured reason and land in audit. Use bash control when the agent wraps file access in a shell command (cat .env) instead of a Read tool.

Real-world examples

Keep the agent inside the monorepo

Scene: “Refactor auth across packages.” The agent reads and edits under apps/, packages/, and tests/.

Policy: Allow contains apps/, packages/, src/, tests/, docs/. Deny ../ escapes if you see them in practice, or tighten to repo-relative prefixes your hooks report.

Outcome: Productive edits stay in-tree; Live wire shows allow on normal source paths.

Secrets and keys never leave the disk into context

Scene: Debugging “why isn’t the API key loading?” the agent tries to Read .env, .env.production, ~/.ssh/id_rsa, or credentials.json.

Policy: Deny (hard) on .env, .pem, id_rsa, .ssh/, credentials, kube/config, secrets/. Soft ask is unreliable on Cursor—prefer deny to block.

Outcome: The agent is told the path is blocked; engineers paste sanitized snippets themselves if needed. Pair with prompt control for keys pasted into chat.

Also common

• Infra configs: Deny terraform.tfstate, production kube contexts, *.pem under deploy folders; allow *.tf / *.yaml under a safe infra/dev/ prefix if desired.
• Home-directory drift: Agents sometimes Read absolute paths under /Users/… or /home/… outside the workspace—deny or ask on those prefixes.
• Behavior Guards: Repeated writes to secrets paths also feed Privilege Streak and Destructive Burst; path rules still stop the first touch.

Allow and deny starters

Allow (examples)

• src/, apps/, packages/, tests/, docs/
• Draft paths your team uses for PRs (*.md under docs/)

Deny (examples)

• .env, .env., credentials, id_rsa, .pem, .ssh/
• kube/config, secrets/, terraform.tfstate

Author in Relay → Rulebook with resource_kind=path. Matching badge: contains.