Blocked Files

Sometimes you want the model to never touch a file, no matter what. A production secrets file, a private key, a credentials cache. .agentblock lets you declare those files once, and Polytoken enforces the block for every tool, every session, and every permission mode.

What a .agentblock file does

A .agentblock file uses gitignore syntax. Every path it matches is permanently blocked from agent access. The model cannot read, write, edit, or reference those files through any tool.

The block is unconditional and applies in every permission mode.

Syntax

.agentblock uses the same pattern syntax as .gitignore. If you know how to write a .gitignore file, you already know how to write a .agentblock file.

# Block all .env files
*.env

# Block an entire directory
secrets/

# Block a specific file
config/database.yml

# Negation: un-block something a broader pattern caught
!.env.example

Patterns match relative to the directory containing the .agentblock file. A pattern in the project root .agentblock applies to the whole project. A pattern in config/.agentblock applies only to files under config/.

Where .agentblock files live

You can place a .agentblock file at the project root or in any subdirectory. Polytoken discovers all of them at startup and on /reload.

A .agentblock file in a subdirectory scopes its patterns to that subtree. Files outside the subtree are unaffected.

Implicit blocking

Any file named .agentblock is itself always blocked from agent access, even if no .agentblock files exist in the project. This prevents the model from reading your security policy and attempting to work around it.

Which tools are affected

The block applies to every tool that reads, writes, or references files:

• file_read, file_write, file_edit_search_replace, patch_edit
• flag_important
• Shell commands that access blocked paths (cat, head, tail, cp, mv, rm, and similar file-access executables)
• glob and grep results silently exclude blocked paths

When the model tries to access a blocked file, Polytoken returns a clear error message explaining the block. The conversation stream shows a card so you can see what was attempted.

Reloading

Polytoken re-reads .agentblock files when you run /reload. If you add or change a .agentblock file, run /reload to apply the changes without restarting the daemon.

No config keys

.agentblock is file-based. There are no configuration keys to set. You control access purely by placing .agentblock files in your project tree.