Build with Agents: Delegated Coding, Mandates and Sandboxes

All courses / AI Developer / Module 2 / Chapter 8

Learning objectives

After the lesson the participant can:

Explain how a mandate, a sandbox and credentials together set the authority of a coding agent
Design the sandbox controls for filesystem, network, secrets, tools, untrusted input and budgets
Compare the case for concern and the case for calm on agents that write and merge code, and state where they meet
Draft a mandate manifest with a never list, budgets, stop holders and a review date

Key concepts

Mandate manifest: The written, versioned statement of what an agent may do, with what, on what, for how long and at what cost, and who can stop it. It is subordinate to the delegation profile, and its never list closes the routes by which an agent could change its own governance.
The sandbox makes the mandate true: An ephemeral container with one repository, egress denied except to the package proxy, no secrets, a one-run identity issued by a service the agent cannot reach, and budgets enforced by the host. It is not a defence against intent, since a model intends nothing.
Untrusted input and the rule of two: Text in issues, comments, documentation or command output can be treated by the model as an instruction. The design check is that no run combines untrusted input, sensitive access and the ability to change state or communicate externally.
Stop path outside the agent: An agent can be stopped inside the agent, at the harness or at the identity. The stop must not run through the pipeline the agent's pull requests trigger, and stopping does not undo what was done: Revert is a separate test.
Writing, merging and deploying: Three acts that are often confused and get different answers. The chapter's verdict is writing at Level 2 Supervised with a reviewer who is not the requester, and a pipeline merge only for a narrow listed class whose gate the change cannot alter.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Sort

Which sandbox control is this

Sort each control into the part of the sandbox the chapter assigns it to.

Interactive exercise 2 · Scenario

Who approves the agent's pull request

Apply the mandate rules the chapter describes for Nordvik Region's platform team.

Teaching plan

15 min	Lecture on what a coding agent is, how it differs from an assistant, and what the evidence on agents does and does not show.
20 min	The teacher walks through the mandate MND-HM-DEV-02, the sandbox controls and the run record; participants say which control enforces each line of the never list.
20 min	Structured debate in two groups: the case for concern and the case for calm on whether agents should write and merge, followed by the five points where the positions meet.
25 min	Exercise: groups write a mandate for a coding agent by the eight steps of the practical guide.
10 min	Each group states how its stop would be tested this quarter and who is reachable out of hours.

Discussion

The calm side argues that a human click is not in itself a control. What would make an approval a real control in your team rather than a click?
Review capacity is finite and is a number. How would you establish how many agent pull requests a week your team can review well?
The run record holds what the agent did, not what the engineer typed. Why does the chapter draw the line there, and who should agree to it?

Written exercise

Exercise · 25 minutes

Write the mandate of a coding agent

For an agentic tool your team already uses, or for the platform team of Nordvik Region, write a mandate. Name the task class and the repositories, and exclude the security-critical paths. Set the level per work class under the ceiling of the delegation profile, with the evidence for each level and its age. List what the agent may do and what it may never do, in terms of paths and actions a sandbox can enforce. Specify a one-run identity, numeric budgets and halt rules, who is told when a rule fires, the stop holders with one reachable out of hours, the mechanism outside the pipeline, who writes the run record, and the review date.

Deliverable: A mandate manifest with levels, allowed actions, a never list, identity, budgets, halt rules, stop holders and a review date.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

Which rule about approval does the Nordvik Region mandate MND-NR-DEV-01 contain?
Show the answer
C. The person who starts the run does not approve its pull request
The mandate sets Level 1 Assisted for drafting, a one-run identity, egress only to the package proxy, no secrets, a branch limit and the rule that whoever starts the run does not approve its pull request.
Why must the stop path not run through the pipeline that the agent's pull requests trigger?
Show the answer
B. Because if a pipeline job stops the agent, a broken pipeline leaves it running
The chapter's reason is that if the agent is stopped by a pipeline job, a broken pipeline leaves it running. The mandate therefore names two mechanisms outside the pipeline: revoking the run's identity and disabling the runner pool.
In the chapter's table of ceilings for a coding agent, what applies to the work class review?
Show the answer
A. Level 0 Advisory: an AI review comment never counts as an approval
For a coding agent the table sets review at Level 0 Advisory, with two human approvers where the change policy requires them. An AI review comment never counts as an approval.