t3-p3-06authored3–5h
Sandboxing and permissions per role
requires: t3-p3-05
Spec
Restrict what each role may do - only the implementer edits files, only you merge to the main branch - and document the permission boundaries.
Why this matters
Least privilege applied to agents. A planner that can edit files will eventually edit files, and you will discover it in a diff you did not expect to contain changes.
Verify
No result yet. Run `learn verify t3-p3-06` locally, or push to trigger CI.
artifact
unrun
judge
unrun
Rubric
# t3-p3-06 — Sandboxing and permissions per role
**Task:** Restrict what each role may do - only the implementer edits files, only you merge to the main branch - and document the permission boundaries.
**Strong:** Directly answers every one of the review questions below in the affirmative, with specific evidence from the actual work, not a restatement of the task.
- Is each boundary technically enforced, or only stated in a prompt?
**Passing but weak:** The deliverable exists and technically satisfies the spec, but is generic, restates the task instructions instead of engaging with them, or only partially addresses the review questions below.
**Fails:** The deliverable is missing, or engages with none of the review questions below - e.g. it describes what was built without explaining the reasoning the task actually asks for.