Blocked Files

Use .agentblock to block file-tool access to production secrets, private keys, or credentials caches. Polytoken applies the rules in every session and every permission mode. Shell commands receive a more limited check, described under Which tools are affected.

What a .agentblock file does

A .agentblock file uses gitignore syntax. Polytoken denies file-tool requests to read, write, edit, or flag matching paths and excludes those paths from file searches and references. Shell checks cover direct invocations of specific file-access commands, not every way a shell command can access a file.

Syntax

.agentblock uses the same pattern syntax as .gitignore.

# Block all .env files
*.env

# Block an entire directory
secrets/

# Block a specific file
config/database.yml

# Negation: un-block something a broader pattern caught
!.env.example

Patterns match relative to the directory containing the .agentblock file. A pattern in the project root .agentblock applies to the whole project. A pattern in config/.agentblock applies only to files under config/.

Where .agentblock files live

You can place a .agentblock file at the project root or in any subdirectory. Polytoken discovers .agentblock files when checking a path, searching the path’s directory and its ancestors up to the project root. Each directory’s rules stay in effect for the session.

A .agentblock file in a subdirectory applies its patterns only to paths in that subtree.

Implicit blocking

Polytoken always blocks agent access to any file named .agentblock, even in a project with no blocking rules. This prevents the model from reading your security policy and attempting to work around it.

Which tools are affected

Polytoken enforces .agentblock rules at these points:

• file_read and file_read_hashline
• file_write, file_edit_search_replace, file_edit_hashline, and patch_edit
• flag_important
• Shell commands that start with a supported file-access executable and include a blocked path as an argument. The check covers readers (cat, head, tail), pagers (less, more), and editors (vi, vim, nano, emacs). It also covers cp, mv, rm, tee, dd, source, and ..
• glob and grep (results silently exclude blocked paths)

The shell check examines only the first executable in the command. Do not rely on .agentblock to prevent access through pipelines, wrappers such as bash -c, or redirects from commands outside the supported set.

When the model tries to access a blocked file, Polytoken returns an error message naming the blocked path. The conversation stream shows a card describing the attempted access.

Reloading

Run /reload after adding or changing a .agentblock file. Polytoken then reads the updated rules on the next path check, without restarting the session.

Symlinked .agentblock files

Polytoken follows symlinked .agentblock files by default. Set daemon.follow_symlinks_for_configs to false to skip symlinked .agentblock files; Polytoken logs a warning for each skipped file. That key also governs symlink following for other configuration and context files, such as AGENTS.md, skills, and facets, so turning it off changes how Polytoken loads those files.