Everyone's building elaborate setups for AI agents:
- Permission systems
- Policy engines
- Audit logs
- Sandbox frameworks
- Multi-layered safety stacks
And they're all missing the point.
The minimum viable setup
You need exactly one thing: a drive letter.
Create a folder for the task, map it to a drive on Windows, point the agent at that drive. That's the whole setup.
No permissions to configure. No policies to write. No logs to review.
Why this is enough
Because the worst thing that can happen is the agent deletes everything inside that drive. Which is fine — it's a throwaway workspace.
It literally cannot touch anything outside of the drive. The filesystem enforces that. Not the AI. Not your prompt. The OS.
The tool
I use ScsSubst (https://subst.scsoi.com/) to create these mapped drives. $9.99 lifetime, one-time purchase. It makes persistent mappings that survive reboots.
What you don't need
- You don't need a VM
- You don't need Docker
- You don't need a policy engine
- You don't need an audit log
- You don't need a permission system
You just need a drive letter.
The workflow
- Create a new folder
- Map it to a drive
- Point the agent at it
- Do the work
- Review the results
That's it. Five steps. Takes 10 seconds.
The bottom line
AI agent safety doesn't have to be complicated. The simplest setup that works is the one you'll actually use.
A mapped drive letter takes 10 seconds, costs $10 one time, and gives you a real OS-level boundary. That's the minimum viable AI agent setup.
Top comments (0)