Each workspace runs under a sandbox profile: writes scoped to its worktree, a network allowlist, secrets kept out of reach, and a hard spend cap.
A git worktree keeps parallel work apart. It isn't a security boundary.
The sandbox profile is what the coding agent, the project scripts, and the terminal all run under, set per workspace. It has four layers you can switch on and off independently:
Two presets cover the common cases, and any mix in between is allowed.
All four layers on. This is the default, and it's what a workspace you leave running unattended should be on.
A workspace starts on its repository's default profile. It can tighten a layer on its own, but loosening one is something you do per workspace, on purpose.
The profile is one policy; the muscle behind it is whoever does it best. An agent that ships its own OS-enforced sandbox gets Cohalen's policy written into it, rather than a second cage built around the first. Everything that sandbox can't reach stays under Cohalen's own enforcement: the terminal, the project scripts, agents that bring no sandbox of their own, and Windows.
The profile always tells you which enforcer is in force. A profile that claims a layer nobody is enforcing would be the defect.
In a box, the box itself is the boundary: one workspace per machine, so there's no neighboring work to confine it from. The egress allowlist still applies, expressed through the vendor's own network policy where it has one.
The profile lives in config Cohalen owns, and Cohalen never commits it to a repository. So an agent can't edit its own cage through the files it works on.
With the network layer on, a workspace reaches only the hosts on its allowlist. Everything else gets turned down.
Enforcement never leaves your custody, and it works with whatever proxy you already use instead of replacing it.
The default list covers the common package registries, GitHub, and certificate authorities. The active agent's own API endpoints are always allowed, so the agent keeps working. You widen the list in Settings, and a file committed to a repo never can.
The fourth layer is the budget: when a turn's spend crosses the workspace's cap, the turn stops. The spend page owns the meter, what it covers, and where the rest of the money goes.
No profile turns the cap off quietly. Runaway cost comes from accidents, not only from code you don't trust. That's what lets you leave agents working unattended: the worst case has a number on it.
Terminal and Project scripts
Run real shells inside a workspace, and share the setup, run, and archive scripts that give every workspace the same workflow.
Spend, live
Agent usage and box cost, per workspace, member, and organization. One cap pauses the fleet. Connect Stripe, and your revenue joins the same timeline.