Projects & Sandbox

A project is the unit of setup in Agent Ops. Everything a task needs — instructions, model, integrations, skills, credentials, files — lives on the project, and every task in the project shares it.

One project, one persistent workspace

Each project owns a persistent Linux sandbox. It is created on first use, suspended when idle, and woken transparently the next time a task runs — with its files intact. That means:

• Files created in one task are available to every later task.
• A cloned repository stays cloned; installed packages stay installed.
• Recurring tasks (a weekly report, a nightly check) naturally build on their own previous output.

Everything under the sandbox's /workspace is indexed into the project's Files tab automatically after each run — there is no explicit "save" step. Files you upload to the project land in the workspace too, so the agent can read them directly.

The project prompt

The project's prompt is its system prompt — standing guidance applied to every task. Good project prompts read like a brief for a new team member:

You are the operations agent for Acme's finance team.
Amounts are in EUR unless stated otherwise. Fiscal year starts in April.
All reports follow the format in the "finance-report-format" skill.
Never email anything outside the company without explicit approval.

Task descriptions then only need to say what's different about this task.

Model

Each project selects one model that powers all of its runs. Choose it for the hardest work the project does — the same model handles planning, tool use, and writing.

Runtime settings

The project's Settings panel exposes safety switches that shape how autonomous the agent is:

Setting	Default	Effect
Auto-approve safe tools	On	Read-only and low-risk tools run without approval prompts; risky ones still pause for you.
Read-only mode	Off	The agent can inspect but not modify — useful while you evaluate a new project's behavior.
Allow child tasks	On	The agent may propose subtasks to split large work.
Auto-run child tasks	Off	When off, created subtasks wait for you to start them.
Require approval for git push	On	Every git push pauses the run for explicit approval.

The pattern for adopting Agent Ops on sensitive work: start with everything gated, watch a few runs, then relax the switches you no longer need. See Approvals & Human-in-the-Loop.

Environment variables

Projects hold environment variables (for example GITHUB_TOKEN, API_BASE_URL, database DSNs) that are injected into every command and code execution in the sandbox.

Security properties worth knowing:

• The agent is told the names of available variables, never the values — it writes $GITHUB_TOKEN into commands and the value is injected at execution time.
• The agent is instructed never to print or log secret values.
• Values are entered in Settings and displayed as name badges only.

This is how you give the agent access to private repositories and internal APIs without pasting secrets into prompts:

Clone https://$GITHUB_TOKEN@github.com/acme/backend.git and review
the open TODO comments in the payments module.

Capabilities

Some capabilities are opt-in per project. The browser capability adds interactive web tools (navigate, click, type, extract, screenshot) on top of the always-available web search and page extraction. Leave it off unless tasks need to interact with pages — the agent will tell you when a task would require it.

Project screens

• Overview — recent activity and project health at a glance
• Tasks — every task with live status
• Files — the indexed workspace: uploads, deliverables, artifacts
• Configure — Actions, Skills, Templates, and Automations