---
name: domain-lock
description: Per-agent filesystem permissions. Each agent can only access files within its domain. Prevents cross-contamination.
user-invocable: true
---

# Domain Lock — Per-Agent Permissions

Set up per-agent filesystem permissions to prevent cross-contamination.

## Permission Levels

| Level | Behavior | Example |
|-------|----------|---------|
| read: false | Can't even see files | .env secrets |
| upsert: false | Can read, can't write | Read-only systems |
| delete: false | Can read+write, can't delete | Source code |

## Example Configuration

```yaml
domain_permissions:
  frontend-dev:
    - path: "src/frontend/"
      read: true
      upsert: true
      delete: false
    - path: "."
      read: true
      upsert: false
      delete: false

  qa-engineer:
    - path: "tests/"
      read: true
      upsert: true
      delete: false
    - path: "."
      read: true
      upsert: false  # Read-only outside tests/
      delete: false

  security-reviewer:
    - path: "."
      read: true
      upsert: false  # NEVER write
      delete: false
```

## Benefits

- No cross-contamination between agents
- Defense in depth: compromised agent has limited blast radius
- Parallel safety: multiple agents don't conflict

$ARGUMENTS
