Scoping an AI agent with tags, not folders

Tag every file by what it is, such as business, client, money or journal, and give each agent a list of the tags it may read instead of a folder to stay in. Folders and rules files get you part of the way, but a boundary only holds when something checks the tag before the agent sees the file.

Why folders are the wrong unit

A folder records where a file lives. Scope is about what a file is, and the two drift apart all the time: a meeting that’s half client work and half personal, a receipt that belongs to both sides, a journal page saved in the inbox by mistake. Scope by folder and each of those is either missed or leaked.

A tag travels with the file. Tag a page Journal and it stays out of a business agent’s reach wherever it’s saved:

# clients/acme-corp/2026-09-11-pilot-call.md
type: Meeting
tags: [Meeting, Business]

# inbox/2026-09-12.md, saved in the wrong folder
type: Journal
tags: [Journal, Life]

Write the scope per job

Before any setup, write down each agent’s job and the tags that job needs. A plan for a company of one might look like this:

Agent        Job                               Allowed tags
Business     invoices, follow-ups, updates     Business, Client, Money, Shared
Marketing    posts from notes and ideas        Notes, Ideas, Resources
Acme Corp    one design partner, nothing else  Acme Corp
Personal     training, meals, the week         Life, Shared

Written down, each list is short, and the journal is on no business list at all. The plan also tells you which tags every file needs, which is the part to get right first.

The do-it-yourself options, and where each stops

Open the agent in a subfolder. Start Claude Code, Codex or Cursor inside business/ and it works there. That’s a sensible default, not a wall. Claude Code’s own docs are candid about it: its file tools ask before reading outside the start folder, but its read-only shell commands reach further unless you turn on a stricter setting or its sandbox. And a file saved in the wrong folder is in scope by accident.

Rules in a context file. A line in CLAUDE.md or AGENTS.md, such as “Never read journal/.” That’s an instruction, not enforcement: Claude Code’s docs describe CLAUDE.md as context rather than enforced configuration. A long session, or a new model, can drift past it.

A separate folder per agent. Business in one folder, life in another, each opened by its own agent. It’s the strongest wall you can build by hand, and it costs the most. The questions that matter cross it: whether you can take August off needs both the ledger and your plans. You also keep two structures, and files both sides need get copied and drift apart.

All three draw the line by location. None of them knows what a file is.

Tags as the boundary, done by hand

If you build tag scope yourself, four rules keep it honest:

• A short, closed list of scope tags. Business, Client, Money, Shared, Life. An invented tag is how a file slips through.
• Tag at creation. A file with no scope tag stays out of every agent’s reach until it gets one.
• Allow lists, not deny lists. A business agent gets Business, Client, Money and Shared. A new tag stays dark until you add it.
• Enforce it outside the agent. Asking an agent to skip Life files is a request. A script that copies only the allowed tags into a folder, with the agent run in a sandbox or container that sees only that folder, is a boundary.

That last rule is where doing it yourself gets expensive. Each agent needs its own filtered copy, rebuilt before every session, and whatever the agent writes lands in the copy, not the original.

Where Oknola fits

In Oknola, tags are the permission model, not folders (how it works). Oknola types, tags and files what lands in the folder, so every file carries its tags from the start, and each agent gets only the tags you allow: a business agent gets your clients and your ledger, and your journal stays dark, whatever folder it sits in. Run one agent per job, each with its own tags. Agent off, your files never leave your device. Agent on, you chose the scope.

In the demo, the Business agent answers which design partner is stalling, then refuses to say how you slept, because Life is switched off. What is available today is on the roadmap.

Questions people ask

Is a rule in CLAUDE.md enough?

For low stakes, it’s a fair start. It’s still a request the agent can miss. Files that must stay private need a boundary that doesn’t depend on the agent’s attention.

What if a file belongs to both sides?

Give it a shared tag, and decide per agent whether shared is allowed. Keep that list short: a calendar and the odd receipt, not whole projects.

Does the model provider see what the agent reads?

Yes. What an agent reads goes to the model behind it, which is the best reason to scope it. In Oknola, agent off means your files never leave your device.

Can one person run several agents?

Yes, and one per job is cleanest: one for the business, one for your life, one per client, each with its own tags. An agent for one client only walks through the last one.