Security and Sandboxing

Every agent in your roster is, in security terms, a process running attacker-influenced code. Treat it accordingly. Sandboxed filesystem access (only the workspace's repo, not your home dir). Sandboxed network access (allow list, not deny list). Secrets injected via short-lived tokens, never via plain env. Audit logs that survive role compromise.

Antigravity provides defaults for all of this; the failure mode is teams loosening defaults to debug something and forgetting to tighten them again.