IAM.Agent: external CLIs and native permissions

Preserve CLI policy, diagnose headless approval refusal and select Cursor's native route.

Availability

This guide applies to Enterprise development builds from source 91c6d27d: macOS ARM64 and Linux x86_64. Full engine regression and focused CLI checks passed; the Linux application was launched. The macOS archive has ad-hoc signing, remains unnotarized and has not been checked in a new interactive session. This is not a public installer. Obtain the exact archive and SHA256 from your operator. Older 01bd5aec and c709 builds retain their earlier CLI arguments and environment. Vendor account/model availability and a real Windows run require separate qualification.

Prepare the CLI

  1. Install the desired CLI separately and complete its normal sign-in. IAM.Agent neither provisions a new account nor changes the CLI’s global profile.
  2. In Enterprise open Settings → Defaults → Provider and select the configured CLI provider. Set Default model as appropriate. Configure the folder separately under Settings → Workspace → Workspace root. Adapter support does not replace native account rights, workspace trust or model availability.
  3. Use Cursor (CLI) and native Auto selection for the existing CLI account route. External CLI children exclude inherited and explicit IAM_* variables and CURSOR_API_KEY. HOME, PATH and other native vendor account/profile variables remain available. This boundary does not promise that every possible third-party secret is removed. The separate Cursor SDK retains its own configuration; SDK qualification uses Composer 2.5 or Auto.
  4. Review the exact task and workspace before delegation. Permission to delegate does not authorize every nested CLI file operation.

Permissions and refusal

Enterprise adds no approval, sandbox, trust or native-hook bypass flags. The installed CLI’s normal settings remain authoritative. IAM.Agent does not add an OS sandbox: an existing native profile may itself allow actions.

If the CLI requires interactive approval unavailable in headless mode, the operation remains an error. In the LLM provider adapter, explicit permission/approval/trust refusals receive blocked_by_policy so the orchestrator cannot repeat them through another route. Do not enable a permission bypass to work around the error. Check rights through the CLI’s normal path, then separately decide whether a new task is appropriate; previous side effects are not undone.

Codex delegation uses current codex exec, not legacy -q. Tasks remain literal and JSONL uses the native parser. Codex max_turns is refused before launch because the installed CLI does not support that option. Explicitly remove the unsupported cap or choose a compatible route; the wall-clock timeout remains separate.

The new checks use real local synthetic executables to verify refusal, absence of the SDK key in Cursor CLI, Auto preservation, no second launch and a delegated failed state. They invoke no paid model or new vendor sign-in.