Blueprint AgentProfiles and Policies

Profiles and Policies

Profiles configure how an agent runs. They package model choice, tool access, permissions, and guardrails into a reusable sidecar profile that the runtime enforces. This is how the workbench configures agent execution without hard-coding behavior into every task.

What A Profile Controls

  • Model selection: primary and small model routing per profile.
  • Per-agent tuning: distinct configs for plan/build/explore (prompt, temperature, max steps).
  • Tool access: enable or disable individual tools.
  • Permissions: edit, bash, web access, and tool-server access (ask/allow/deny).
  • Command scoping: bash can be limited by command allowlists.
  • Tool servers: allowlisted local or remote servers with headers, env, and timeouts.
  • Plugins: allowlisted extensions that can be attached to the runtime.
  • Inheritance: extend a base profile and override only what changes.

A profile does not pick the coding harness. Blueprint Agent sessions run OpenCode. Choosing between OpenCode, Claude Code, Codex, and the other supported harnesses is a Sandbox feature, set per sandbox rather than per profile.

Guardrails And Validation

Profiles are validated before execution. Security policies can cap permissions (for example, “bash” at ask), block local tool servers, and require allowlisted plugins. Profiles that exceed policy are rejected so the runtime stays safe and predictable.

Base, Variant, and Per-Run Profiles

The workbench exposes profile controls today:

  • Base profiles for org-wide defaults, inherited with extends.
  • Custom profiles for team or project overrides, created and edited from the profile selector in the chat composer.
  • Per-run selection: pick the profile a session runs under before each run.

The runtime merges overrides with the base profile, validates the final config, and applies the result to the sidecar session.

Example Profile (Conceptual)

{
  "name": "team-default",
  "extends": "baseline",
  "model": "provider/model-id",
  "small_model": "provider/model-small",
  "agent": {
    "plan": { "temperature": 0.2, "maxSteps": 8 },
    "build": { "temperature": 0.1, "tools": { "git": true, "bash": false } },
    "explore": { "temperature": 0.7 }
  },
  "permission": {
    "edit": "ask",
    "bash": "ask",
    "webfetch": "allow",
    "mcp": "ask"
  },
  "tools": {
    "git": true,
    "search": true,
    "bash": false
  },
  "mcp": {
    "internal-search": {
      "type": "remote",
      "url": "https://tools.example.com/mcp",
      "timeout": 10000
    }
  }
}

For a field-by-field reference, see Profile Schema. The schema is harness-aware; each backend maps the shared profile fields to its own config surface. See Sandbox Harnesses for the centralized sandbox list and the smaller AI Agent Sandbox blueprint sidecar list.

SimulationsProfile Schema