Advanced

Host access and unattended runs, done carefully

This page is for you if your agent has proved itself on safe jobs and you now want it to work on real files or run while you are away. Those are rungs 2 to 6 of the ladder on Safety versus capability. Here you get the setup that makes each rung survivable: a folder you can restore, an account the agent cannot escape, limits on who can reach it and what it can spend, and a log you actually read.

Applies to: Agent Zero, Atomic Agent, Hermes Agent, OpenClaw, Goose, NanoClaw, QwenPaw, Eigent, Everfern, and OpenManus. Every agent here can reach some files and run some commands, so the general steps apply to all ten. The switches differ, and they are listed agent by agent near the end.

Warning: An approval only means you said yes. Atomic Agent, Eigent, Hermes, and OpenClaw all say in their own docs that an approved command runs with your account's full permissions, so a folder setting or an approval is not a wall. The walls on this page are the separate account, the virtual machine, and the container.

Climb one rung at a time

Page 7 asks three questions about any setup: what the agent can reach, whether a mistake can be undone, and whether someone is watching. Each section below changes one answer. Work through them in order, and stay on each rung for a week of ordinary jobs before you add the next.

Rung What changes What this page adds
2. Watched, with chosen files The agent reaches real files. A dedicated folder and a backup
3. Watched, with the web The agent reads pages that can carry prompt injection. A separate account on your computer, or a virtual machine
4. Unattended, low stakes Nobody watches while it runs. Spend limits and logs
5. Reachable from your phone Messages reach it from outside. Allow lists
6. Accounts and money It can send, post, pay, or delete. Accounts made only for the agent

A dedicated folder, with a backup

Give the agent one new, empty folder and copy in only the files for the job. Keep the originals somewhere else. Most agents can still reach past that folder, as the warning above says, but a single folder means the mess stays small and the backup stays simple.

  1. Make a new folder, such as agent-work in your Documents folder.
  2. Copy, do not move, the files for the job into it.
  3. Before each run, copy the whole folder to a second place with a date in the name, such as agent-work-backup-2026-11-14.
  4. For a backup that keeps running, turn on your computer's own tool. On Windows, open Control Panel, then System and Security, then Save backup copies of your files with File History, and click Turn on with an external drive connected. On a Mac, open System Settings → General → Time Machine and click Add Backup Disk.
  5. Point the agent at the new folder, using its own setting from the agent-by-agent section below.

What you should see the agent's file list shows only the copies in agent-work, and your dated backup folder holds the same files.

On Windows, File History covers your libraries, so add the folder with Show more options → Include in library if it lives elsewhere. Agent Zero keeps its own workspace in a container, so it has separate backup buttons, covered in Step 8: Advanced Agent Zero.

You gain: a mistake on real files becomes a restore instead of a loss.

You risk: a backup you never test. A copy made after the damage also copies the damage, which is why step 3 happens before each run.

Makes sense when: always, before any agent touches files you care about. Open one backup and check it once, so you know it works.

A separate account on your computer

Agents that run on your computer, rather than in a container, run commands with the permissions of the account that started them. A second, standard account for the agent cannot open your personal folders by default, and it cannot install system software without an administrator password. OpenClaw's docs recommend a dedicated account for the same reason, and Hermes's checklist says never to run its gateway as root, the Mac and Linux administrator.

On Windows:

  1. Open Settings → Accounts → Other users and click Add account.
  2. Click I don't have this person's sign-in information, then Add a user without a Microsoft account.
  3. Enter a name such as agent and a password, and click Next.
  4. Leave the account as a standard user. Do not change it to Administrator.
  5. Sign out, sign in to the new account, and install the agent there.

On a Mac:

  1. Open Apple menu → System Settings → Users & Groups and click Add User.
  2. Choose Standard as the account type, enter a name such as agent and a password, and create the user.
  3. Make sure automatic login is not set for an administrator account.
  4. Log out, log in to the new account, and install the agent there.

What you should see from inside the agent account, opening your own user's Documents folder is refused. If it opens, the new account has more rights than it should, so stop and check its type.

A separate account does not cover everything. Shared places such as the Public folder and external drives can stay reachable, so keep private files out of them.

You gain: a mistake or a hijacked step can only reach the agent's own account, not your photos, email, or saved passwords.

You risk: more setup, and some agents expect an administrator to install them. If you type an administrator password whenever the agent asks, the separation is gone.

Makes sense when: the agent runs on your real computer and can reach the web or real files. Agent Zero and NanoClaw already work inside a container, so this matters most for the others.

A virtual machine, for a stronger wall

A virtual machine keeps its own files and its own accounts, so an agent inside it cannot see your files unless you share a folder in. The price is its own share of your memory and disk.

On Windows 11 Pro, Enterprise, or Education, Hyper-V is built in. Windows 11 Home does not include it.

  1. Open Control Panel → Programs → Programs and Features, and click Turn Windows features on or off.
  2. Tick Hyper-V, click OK, and restart.
  3. Open Hyper-V Manager and create a new virtual machine with the wizard.

What you should see a new machine in Hyper-V Manager that starts in its own window.

Windows Sandbox is a quicker option on the same editions. It is disposable, so closing it deletes everything inside, and its network is on by default. That suits a one-off trial of an agent, but it cannot keep a scheduled agent running between sessions.

On a Mac, UTM is a free, open-source app that runs virtual machines with Apple's own system on Apple silicon.

  1. Install UTM from its site and open it.
  2. Click + and follow the wizard to create a new virtual machine.
  3. If the agent needs files, share only the agent-work folder with Browse… in the sharing step.

What you should see a new machine in UTM's list that starts in its own window. UTM can also save a snapshot of the machine, which you can return to after a bad run.

This guide could not confirm a tested recipe for running Docker inside one of these virtual machines. Agents that need Docker are often easier to keep in their container on the main computer instead.

You gain: the strongest wall on this page. An agent that drives the screen, such as Everfern's computer use, drives the virtual machine's screen instead of yours.

You risk: slower work, a larger memory and disk bill, and a folder share that brings your files straight back into reach if you share too much.

Makes sense when: the agent runs on your real computer, has no container of its own, and you want it to browse or run commands while you are not watching.

Accounts made only for the agent

Rung 6 means the agent signs in to real services. Give it its own: a new email address, a new cloud folder, and a new API key, each made only for the agent. Never sign it in to your personal email, password manager, bank, or main browser profile. OpenClaw's docs say the same thing, and they add that the agent's runtime should not be signed in to personal Apple or Google accounts.

Note: One account for one agent is a safety step. Making several free accounts to get around a provider's limits is a different thing, which this guide does not cover because it breaks those providers' terms.

  1. Create one email account for the agent with any provider, and use it only for the services the agent needs.
  2. Make a separate API key for the agent with its own limit. On OpenRouter, give the key a Credit limit. With Anthropic, put the key in its own workspace with its own spend limit. With OpenAI, put it in its own project and set Project settings → Limits.
  3. Share only what the job needs with the agent's account, such as one shared folder or one calendar, rather than signing it in as you.

What you should see the agent works from addresses and keys that you could delete tomorrow without losing anything of your own.

In October 2026, Moneycontrol reported that one founder's finance agent posted bank details to a company Slack channel. The bank access was read-only, and the article said several of his agents shared the same connections. Separate accounts would have kept the finance agent away from that Slack.

You gain: a leak or a bad send reaches a throwaway account, and you can cut the agent off in one step.

You risk: more accounts to manage. An agent with its own email can still send mail that looks like it came from you, if the recipients know the address.

Makes sense when: the agent sends, posts, pays, or deletes anything. Keep approvals on for those actions, and give it no access to money at all until it has run well for weeks.

Allow lists

Allow lists can cover people, commands, or sites. Start with the chat users who can message the agent, because without that list a stranger who finds the bot can give it instructions.

Agent Who can message it Setting
Agent Zero Telegram and WhatsApp An empty Telegram allow list or WhatsApp allowed_numbers list means anyone. Fill in your own ID or number.
Hermes Agent Telegram, Discord, WhatsApp, Slack, and more TELEGRAM_ALLOWED_USERS and similar names in ~/.hermes/.env, or pairing. Never set GATEWAY_ALLOW_ALL_USERS=true.
OpenClaw Most chat apps dmPolicy defaults to pairing. Approve yourself with openclaw pairing approve <channel> <code>, and never set it to open.
Atomic Agent Telegram and Discord Both start off, and Telegram binds to one owner.
NanoClaw Many chat apps New chats wait for your approval before they reach an agent.
Goose Telegram, through an experimental gateway No sender allow list was found in its docs, so leave it off.

QwenPaw, Eigent, Everfern, and OpenManus are not in the table. This guide could not confirm a sender allow list for QwenPaw's chat channels or for Eigent's WhatsApp control, and Everfern and OpenManus document no chat channels.

Some agents also take a list of commands or sites. OpenClaw's tools.exec.mode can be allowlist or ask, and QwenPaw has denied_tools for tools that must never run. QwenPaw's network_allow setting lists the sites it may reach, and it allows all sites by default.

What you should see, after you set a sender list: a message from a second phone or account gets no reply, or gets a pairing code that you have not approved.

You gain: only you can steer the agent from outside.

You risk: locking yourself out if you mistype your own ID, which is a safe failure.

Makes sense when: always, before you connect any chat app. An agent reachable with no allow list is on page 7's list of setups that are not for beginners.

Spend limits before anything runs alone

An unattended agent that gets stuck can repeat a step all night, and every repeat costs money on a paid model. Set a monthly spend limit at the provider before the first unattended run, using the steps on Mix a cheap model with a strong one.

A few agents add a step or turn limit of their own, which helps but does not replace the provider limit. Goose stops after GOOSE_MAX_TURNS turns without you, 1000 by default. Atomic Agent's turnBudgetUsd caps one Fusion turn. A prepaid balance, such as DeepSeek's, works as a hard stop because nothing runs once it reaches zero.

What you should see a limit or a small balance on the provider's own page, set before the agent's first scheduled job.

Logs: read what ran

An unattended run is only safe if someone looks at it afterwards. Pick a time, such as the next morning, and check three things: what the agent did, what changed in the folder, and what the provider charged.

Agent Where to look
Agent Zero The chat for each task in the web page, and open logs on the instance's card in Launcher
OpenClaw ~/.openclaw/logs/openclaw-YYYY-MM-DD.log, or openclaw logs --follow to watch live
Hermes Agent ~/.hermes/logs/, including errors.log and gateway.log
Goose goose session list, and the Scheduler page, which lists the sessions each scheduled recipe created
QwenPaw Execution Records for each scheduled task
Eigent Its approval records and audit trail, named in its security policy
  1. Open the log or session for last night's run and read what the agent did, step by step.
  2. Compare agent-work with yesterday's backup and look for files that changed or disappeared.
  3. Open the provider's usage page and compare the charge with what you expected.

What you should see the steps match the job you gave, the folder holds what you expected, and the charge is close to your estimate. Anything else is a reason to stay on this rung longer.

Logs hold private material. OpenClaw writes its log files so only your account can read them and offers openclaw status --all for a version with secrets hidden, while Hermes hides keys in its own logs automatically. Goose deletes its terminal logs after two weeks. This guide could not confirm where Atomic Agent, NanoClaw, Everfern, or OpenManus keep a run log a non-coder can read.

You gain: you catch a bad habit after one night instead of after one month.

You risk: logs that copy secrets. Keep them in the agent's account, and do not paste them into public bug reports.

Makes sense when: every time an agent runs without you. Turning a schedule on without a plan to read its log is the setup page 7 warns about.

Agent by agent

These are each agent's own switches for reaching your computer and running alone. The careful setting comes first, and the setting to avoid as a beginner comes last.

Agent Zero

The container is the wall, and Host access opens a door through it to a folder on your computer. Host access is off by default. You turn it on from the computer icon beside an instance's name in Launcher, and closing that instance's tab stops it. The folder you pick does not limit which commands it can run, so a terminal command can reach past it. Scheduled tasks run with no approval step, and no monthly dollar limit was found in its settings. The steps are on Step 8: Advanced Agent Zero.

OpenClaw

Sandboxing, agents.defaults.sandbox.mode, defaults to off. Set it to all, with workspaceAccess at none or ro, to move commands into a container. On the host, tools.exec.mode defaults to full, which runs commands without asking. Setting it to ask covers shell commands only: OpenClaw's own file tools (write, edit, apply_patch) never ask, and by default they can write anywhere your account can. The two workspaceOnly settings below hold them to the agent's workspace.

openclaw config set tools.exec.mode ask
openclaw config set tools.fs.workspaceOnly true
openclaw config set tools.exec.applyPatch.workspaceOnly true
openclaw approvals get
openclaw exec-policy show

Run the first line, then restart the gateway and run the other two to check. What you should see: the mode now reads ask. When an approval is needed and nobody can answer, askFallback defaults to deny. Scheduled automations are switched on by default. Avoid /elevated full, which steps outside the sandbox.

Hermes Agent

approvals.mode defaults to smart, where a model allows low-risk commands on its own. Set it to manual for rung 2 and above. Scheduled jobs deny risky commands by default (cron_mode: deny), and so do other runs with nobody watching (unattended_mode: deny). A prompt left unanswered for 300 seconds is denied. terminal.backend can be docker or ssh to run commands away from your files. The Docker and cloud backends skip the dangerous-command check, because the container is the wall instead. Avoid --yolo and approvals.mode: off, and never run the gateway as root.

Goose

Goose starts in Autonomous mode, which can change and delete files without asking. Choose Manual Approval under Settings → Chat → Default Mode in the desktop app, then start a new chat, because an open chat keeps its old mode. In the terminal version, /mode approve switches the current session; the desktop app does not recognize that command and sends it to the model as plain text. goose session --container <id> runs a session inside a container you already have. Scheduled recipes run in Autonomous mode whatever you set. A source check in a GitHub issue thread found that Goose's scheduler forces it from v1.46.0 on, because nobody is there to approve, and that a goose_mode line in a recipe is ignored. The official docs do not mention this, so treat every scheduled recipe as running with no approvals.

Atomic Agent

agent.approvalLevel runs from 1, which asks before every gated action and is the default, to 5, full trust, which includes sending email. Raise it one level at a time with atomic-agent config set agent.approvalLevel <level>. atomic-agent overnight denies anything that still needs approval, unless you pass --no-approval. An unanswered Telegram approval becomes a no after 8 minutes.

Warning: Atomic Agent's docs say atomic-agent task run and task tick run at approval level 5, whatever agent.approvalLevel says. A scheduled task therefore has full trust. Keep scheduled tasks to jobs that read and summarize until you have read their logs for a few weeks.

NanoClaw

Commands run in a Docker container by default, without asking each time. NanoClaw asks before an unknown chat reaches an agent, and before an agent installs packages or adds an add-on server inside its container. Egress lockdown, which cuts the container off from the open internet, is off by default.

QwenPaw

Tool Guard is under Settings → Security → Tool Guard, or approval_level in agent.json. The levels are STRICT, SMART, AUTO, which is the default, and OFF. In a run with no live session, QwenPaw's docs say a flagged action is logged and may still go ahead, and they suggest denied_tools for anything that must never run. This guide could not confirm whether a scheduled task counts as one of those runs. Its sandbox starts switched off in v2.3.0. Turn on Enable Sandbox Execution first, and know that even then it can read the whole disk and reach any site by default.

Eigent

Eigent's security policy says its approvals, records, and audit trail are not an operating-system sandbox. A shell command it runs can reach everything your account can. Its site says approvals stay visible and wait for you, even after an interruption. In v1.0.7 it starts in Ask me first.

Everfern

Everfern's README says shell commands run in an isolated Linux virtual machine and that the app pauses before anything destructive. Its computer use drives your real screen and apps, not that virtual machine. In the v1.3.0 code, only commands on your real computer always stop for approval. Other pauses depend on the model choosing to ask, and scheduled runs skip the interactive check.

OpenManus

OpenManus's README describes no sandbox, no approval step, and no schedule, and its example settings show the use_sandbox option commented out. Its browser tool attaches to your own Chrome. Run it only in a virtual machine or a separate account if it will reach anything you care about.

Sources

Checked 14 November 2026.

Checked 14 November 2026 · prices, limits, and versions change