The boundary

Problem

I run agent sessions every day, near a knowledge base that holds information that is not mine to leak. By default, a coding agent can read the full directory in which you open it. A credential, a price, or a private note can go into a session transcript, a commit, or a model’s context. The words “be careful” are not a control.

I spent eight years in behavioral-health operations. In that field, a record in the wrong place causes serious harm. I do not run my own work on good intentions.

System

The knowledge base is an Obsidian vault in one git repository. It is the knowledge layer for each other system here: strategy, projects, people, commercial terms, credentials, synthesis. It keeps me organized, and it gives each agent session its context.

Agent sessions in other repositories never get that repository. They mount exactly two directories: a shared context layer and the single slice for their scope. All other paths are unreachable by construction, not by permission. A session that works on the tool directory cannot address a client folder. The path is not in its world.

A pre-commit hook controls what can enter those mountable directories. It is not a rule that I must remember. The hook fails the commit on money, compensation, credentials, and infrastructure resource IDs. It also makes sure that the mountable set is self-contained, so a mounted file cannot point to a file that the session cannot open. If a machine cannot make sure that content is safe, I delete the content and do not keep it on trust.

The trade is real. The mounted slice is smaller than what I know, so a session sometimes lacks context that I have. That is the correct direction for a failure.