Agent teams with a board

Human gate: Approve-first on push, deploy, spend and wider access · Stack: Node 24 · Postgres · React · WSL2 · bubblewrap · Seed species: Triad

Problem

Agents that write code also want to push it, deploy it, install things and reach the network. Each of those is a decision a person should make. The question was whether an existing control plane for agent teams could be trusted to hold that line, or only looked as if it did.

How it works

The base is Paperclip, an open-source, MIT-licensed control plane for running agents as small companies: an org chart, tasks with review gates, heartbeats, budgets, approvals and an audit trail. This is a private, detached copy, hardened before it ran anything here.

Each team has three roles. A lead plans and assigns. A builder works in a sandbox. A reviewer from a different model reads the diff blind. Agents push to their own branches; a person merges.

Every agent runs inside a bubblewrap sandbox in a locked-down WSL2 distribution, with a scrubbed environment. Its traffic goes through a proxy that allows named hosts only and refuses any name that resolves to a private, loopback or metadata address. Wildcards are limited to one label.

When an agent hits a sandbox limit, it asks. The request becomes an approval of type environment_change. A person approves or rejects it on the board or on the phone, where approval needs a confirm and biometrics and fails closed. The change is applied through the same code a board edit uses, and recorded as a grant that can be revoked in one click.

Method

The upstream code was read before it ran. A security review and an outbound audit came first; the build plan followed from what they found. Push, deploy, spend and anything that reaches a person outside are approve-first.

Results

• A budget hard stop pauses a team that overspends.
• Deploys drain active runs before restarting, and a progress-aware loop breaker stops agents that go round in circles.
• On the phone, a live notification arrives about three seconds after an approval is created. Board keys expire after 30 days and renew when under seven.

What broke

The upstream review found that agent adapters skipped every permission prompt by default, that agents inherited the host’s environment including cloud credentials and the GitHub token, and that in the default local mode any request without a token was treated as the admin. An agent could approve its own approval. The outbound audit also found telemetry on by default and an update command that would reinstall upstream over the copy.

On the phone app: key rotation revoked the old key in the same transaction, so requests in flight got a 401. A comment posted twice on retry until each carried a client request id. The first notification said “requested by an agent” for the owner’s own hire.

Limitations

The phone app has not been verified on a real phone with the app closed. One owner, one machine.

Next

Test the approvals app on a real phone, with biometrics and the app closed.