Governing OpenCode with Alyria
OpenCode agent security and governance starts with the open-source harness and CLI's native permissions, policies and MCP configuration. OpenCode's documentation presents it as an AI coding agent, but the company work an agent performs depends on the tools and responsibilities you give it. For example, a chief-of-staff agent can use OpenCode to manage a company's website and customer service. Alyria Beacon inventories the harness and its connections, Lyra governs model, tool and MCP calls locally, and every decision lands in the hash-chained audit trail.
Start with the vendor's own controls.
Each control below is named the way OpenCodenames it, and links to the vendor's documentation. Deploy them: they are the fastest path to a working baseline.
permissions
Ordered action, resource and effect rules allow, deny or ask before an action. The last matching rule wins; agent rules are appended after global rules.
V2 permissionspolicies
Policies can hard-deny a permission check. Global and Console-managed policies override project configuration.
Policy enforcementmcp.servers
Configure local stdio or remote MCP servers. Use permission actions to deny tools without disconnecting their server; remote servers use OAuth by default.
V2 MCP serversWhat the native controls leave uncovered.
The vendor documentation explains the native controls and their boundaries. Here is how those boundaries affect a fleet running more than one agent harness.
Shell access is host access
OpenCode warns that shell runs with the host user's filesystem, process and network authority. Directory inference from commands is best effort, so its docs recommend narrow shell allowlists.
Defaults are not a company policy
The documented base policy allows actions broadly and asks for reads of environment files. Set explicit permissions and policies for the job instead of assuming the default is an operations security baseline.
A harness policy is not a fleet inventory
OpenCode permissions govern actions in OpenCode. A company also needs to know which other agents and MCP connections exist and keep a common decision record across those harnesses.
A practical starting point.
A V2 native permission baseline for a company agent: allow inspection, ask before shell execution and deny direct pushes. This is a starting point for the harness, alongside the Lyra policy you apply across agents.
{
"$schema": "https://opencode.ai/config.json",
"permissions": [
{
"action": "shell",
"resource": "*",
"effect": "ask"
},
{
"action": "shell",
"resource": "git status *",
"effect": "allow"
},
{
"action": "shell",
"resource": "git diff *",
"effect": "allow"
},
{
"action": "shell",
"resource": "git push *",
"effect": "deny"
}
]
}What OpenCode provides, and what Alyria adds
| Area | OpenCode controls | Governance with Alyria |
|---|---|---|
| Action permissions | Allow, deny and ask rules plus hard-deny policies inside the harness. | Local Lyra policy across model, tool and MCP calls, shared across harnesses. |
| MCP connections | Local and remote servers, OAuth and tool permission rules. | Fleet inventory of agent connections and local MCP policy decisions. |
| Company responsibilities | Custom agents with their own instructions and permissions. | The same governance for a coding session or a chief-of-staff agent managing a website and customer service. |
| Audit and placement | Sessions and agent activity within OpenCode. | Hash-chained decision evidence across the fleet, with governed cloud execution in Statio. |
What Alyria Beacon adds.
Governance at the endpoint, not the gateway: Alyria (alyria.ai) applies the same policy, secrets and audit whether the agent is OpenCode or a different agent harness.
- Alyria Beacon inventories agents, tools, versions and MCP connections on each endpoint, across frameworks and harnesses.
- Lyra applies your written policy locally to model, tool and MCP calls, with no cloud round-trip for the decision.
- Start in Monitor to see what policy would decide, then switch to Enforce when you are ready.
- Every decision lands in a tamper-evident, hash-chained audit trail attributed to the agent and its identity.
- Umbra supplies short-lived credential leases, and Spectra exports the decision signal to your SIEM.
- Statio runs governed agents in the cloud with the same policy and audit, so placement does not change the accountability.
Questions security teams ask about OpenCode and Alyria.
Why put OpenCode alongside agent frameworks and harnesses?
OpenCode is marketed as a coding agent and supplies a harness, CLI, tools and MCP connections. Companies can also assign an agent broader staff responsibilities. Alyria governs the calls, not a job title.
What does a chief-of-staff agent need governed?
An OpenCode agent managing a company website and customer service can read company information, change content and call customer systems. Lyra applies policy to the model, tool and MCP calls, and the audit trail records what each decision allowed or denied.
Should we keep OpenCode permissions?
Yes. Set native permissions and policies for each agent, keep service access least-privileged, and use Alyria Beacon for inventory and the common local governance layer across harnesses.
- Agent foundation
- Open-source agent harness and CLI
- Native positioning
- AI coding agent
- Company example
- Chief of staff for website and customer service
- Policy
- Native permissions plus local Lyra decisions
- Evidence
- Hash-chained audit trail
- Cloud execution
- Governed agents in Statio
See what your agents are wired to.
Start in monitor mode: inventory the AI tools, versions and MCP servers on every endpoint, see what enforcement would decide, and turn on enforcement when you are ready.