The project folder
The default policy lets the agent read and edit everything inside the project (rule project-fs). Outside it, file access goes to your agent’s own prompt, and secrets stay denied everywhere.
How the project is found
Section titled “How the project is found”OpenMoat starts at the folder the agent session runs in and walks up to the nearest folder that holds .git, the root of the git repository.
| You start the agent in | The project is |
|---|---|
~/work/app (a git repository) |
~/work/app |
~/work/app/packages/api (inside that repository) |
~/work/app, the whole repository |
~/scratch/notes (no git anywhere above it) |
~/scratch/notes, that folder only |
A git worktree (.git is a file there) |
The worktree’s folder |
A submodule of ~/work/app |
The submodule only, because it has its own .git |
| Your home folder, or a dotfiles repository in it | No project: nothing is allowed as project files |
What the project gives the agent
Section titled “What the project gives the agent”What this opens
- Read and edit every file in the project
- Builds, tests and everyday git commands there (
dev-shell)
What stays protected
.env,.envrcand keys in the project stay denied- Writes into
.git(hooks, config) ask first: git runs them later, outside any sandbox - Writes to CI workflows,
.husky/,.pre-commit-config.yamland.vscode/tasks.jsonask first (runs-later): CI or a commit runs them later .moat,.claudeand other agent settings stay denied
Think about
- A folder next to the project is outside it: see [Work across several repos](work-across-repos.html)
Monorepos
Section titled “Monorepos”Start the agent anywhere in the repository: the project is the whole repository, so the agent can work across packages without any setting. To keep it to one package, start it in a copy or worktree of just that package, or add a rule of your own with moat edit.