Your Agent's Shell Allowlist Is Bypassable

Tue, 29 Sep 2026 20:30:00 -0700

Every shipmates crew member runs shell commands. Before any of them runs, it goes through a permission gate. The gate uses the same rule syntax as Claude Code settings: Bash(git status), Bash(rm *), Write(**/.claude/settings.json). The rules are merged from several layers:

a fleet-wide deny list pushed from Fleet Command
per-persona policy files
project settings
the Brig, which compiles shipmates’ fifteen “Ship’s Articles” into deny and ask rules

Deny beats ask, ask beats allow.

shipmates: Persona-Based AI Coding Crews That Remember

Fri, 21 Aug 2026 21:18:00 -0700

Since June most of my evenings have gone into shipmates, a Go CLI and daemon for running crews of AI coding agents. I tagged v0.5.0 on August 17th. That was two months and about 240 commits after the first architecture doc. So it’s a good time to write down what it is and why it exists.

The problem

I run a lot of agent sessions. On a normal night this workstation has four or five projects going at once. Each has a few Claude Code sessions doing different jobs: one reviewing, one writing tests, one chasing a bug. Two things kept annoying me.

Ai-Agents on Luther Monson

Your Agent's Shell Allowlist Is Bypassable

shipmates: Persona-Based AI Coding Crews That Remember

The problem