How to tune the coder agent
Permissions, SSH key, working directories and safety rules for the Tech Assistant.
Why tune it
Out of the box the Tech Assistant can monitor and run routines, but to work on your projects it needs access, a working folder and rules.
Step 1. Least-privilege access
- Start read-only: a key without write access.
- Grant access only to the repos/servers you need, not "everything".
- For SSH: a separate 'agent' user with a restricted shell.
Step 2. Working directory
- One root per project, e.g. '~/projects/<project>'.
- Tell the agent: "work only in this folder, touch nothing outside it".
Step 3. Rules in the SOUL context
Describe in the first message:
- which stack and standards you follow,
- where to commit and how to name branches,
- what NOT to do (no pushing to main, no prod changes without confirmation).
Step 4. Human in the loop
- Big changes — only after your "yes".
- The agent writes a plan, you approve, it executes.
Safety checklist
- [ ] Read-only key at the start
- [ ] Separate user, not root
- [ ] No secrets in the chat
- [ ] Confirmation before prod changes
The full project-switching scenario is in a separate article.