Setting up autonomous developer workflows for an entire engineering team brings immediate security and infrastructure hurdles. According to the GitHub repository for OneCLI v2, the project provides an open-source sandboxed agent harness designed to give every employee a secured personal agent. If you are deploying or reviewing team agent infrastructure locally or on Kubernetes using their Helm chart (oci://ghcr.io/onecli/charts/onecli .), you need a fast evaluation method to verify how secrets, sandboxes, and permissions are handled.
Here is a ten-minute audit checklist you can run right now on your agent harness setup to spot structural risks, verify isolation boundaries, and keep your local or self-hosted stack locked down.
1. Inspect Local Development Prerequisites and Ports
Start by checking your local orchestration setup. According to the source, the local development stack uses mise install, pnpm install, and pnpm dev, which automatically generates a .env file containing required secrets, spins up PostgreSQL, runs migrations, and starts the full stack on http://localhost:10254 (or via git clone https://github.com/onecli/onecli.git && cd onecli && pnpm install && pnpm run setup). Check that your local environment file is excluded from version control and that no unauthorized ports are exposed on your host machine.
2. Verify the Outbound-Only Runner and Sandbox Boundaries
Autonomous agents need compute, but they should never leave an unmonitored back door open. According to the documentation, the OneCLI runner is strictly outbound-only and holds no inbound ports, meaning a laptop, homelab, or VPC behind NAT works without ingress or tunnels. Verify your network security groups to ensure the runner cannot accept inbound traffic and that sandboxes rely on a vendor-neutral harness interface supervised from within.
3. Review Credential Injections and the Rust Gateway
Secret leakage is the single fastest way to compromise a deployment. According to the architecture documentation, the Rust Gateway intercepts outbound requests (including HTTPS via MITM) and injects credentials, while the Secret Store uses AES-256-GCM at rest, decrypting data only at request time. Verify that your agent access tokens are handled correctly via Proxy-Authorization headers, and confirm that agents never see raw API keys or administrative connection strings directly in their environment variables.
4. Check Identity Provider and Team Policy Enforcement
Scaling AI tooling across multiple users requires centralized guardrails rather than individual prompt overrides. According to the project specifications, workspaces integrate directly with company Identity Providers to provision agents per employee, enforcing a single unified policy across the board. Confirm that deterministic human-in-the-loop approvals are active in chat channels for sensitive actions such as deleting tickets or modifying storage buckets.
5. Audit the Enterprise License and Repository Boundaries
Before pushing code to production, check your directory structures. According to the repository licensing details, the codebase is licensed under Apache-2.0, with the exception of the ee/ directories which hold enterprise features under the OneCLI Enterprise License. Verify that your production deployments use only the Apache-2.0 compliant paths unless you have secured a commercial subscription for the enterprise feature set.
Check your sandbox supervisor logs and verify that your team's agent harness maintains strict outbound-only boundaries before scaling access to the rest of your organization.