# Quarantine Agent Writes to a Folder They Cannot Leave ## Claim An agent with vault access should write only into a dedicated separate location, never directly into canonical Literature or Permanent notes, so that every generated artifact stays distinguishable from authored ones by its path alone. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Path-based separation is stronger than an instruction, because it survives the agent misreading the instruction. - Makes provenance checkable by any later tool without metadata: the directory is the signal. - Costs a promotion step — someone has to move accepted content into the canonical tree, which is the point rather than the overhead. - Does not protect against an agent given write access to the canonical tree anyway; it is a convention that needs enforcing somewhere. ## Evidence From Nick Milo's session reading Tiago Forte's vault: agent-written material and authored notes are discussed as needing to stay separable. ## Links - [[An Agent With Write Access Needs a Written Boundary File]] — the instructional version of the same control; this note is the structural one, which fails safer - [[Deliberate Links Are the Only Ones an Agent Should Rank On]] — what quarantine protects — the link graph stays a record of my own judgment - [[3. Resources/MOCs/Personal Knowledge Management MOC]] — the PKM thread on keeping generated and authored content separable. - [[3. Resources/MOCs/AI Agent Safety MOC]] — the bounded-action thread; this is the structural control rather than the instructional one.