--- type: Guide title: "How to let an AI read some files but not others — Oknola" description: "Let an AI agent read some of your files but not others: tag each file by what it is and scope agents by tag. The do-it-yourself options and their limits." resource: https://oknola.com/guides/scope-ai-agent-with-tags/ --- [Guides](https://oknola.com/guides/) · For solo founders # Scoping an AI agent with tags, not folders By [Ricardo Cardona](https://oknola.com/about/) · September 21, 2026 Tag every file by what it is, such as business, client, money or journal, and give each agent a list of the tags it may read instead of a folder to stay in. Folders and rules files get you part of the way, but a boundary only holds when something checks the tag before the agent sees the file. ## Why folders are the wrong unit A folder records where a file lives. Scope is about what a file is, and the two drift apart all the time: a meeting that’s half client work and half personal, a receipt that belongs to both sides, a journal page saved in the inbox by mistake. Scope by folder and each of those is either missed or leaked. A tag travels with the file. Tag a page Journal and it stays out of a business agent’s reach wherever it’s saved: ```yaml # clients/acme-corp/2026-09-11-pilot-call.md type: Meeting tags: [Meeting, Business] # inbox/2026-09-12.md, saved in the wrong folder type: Journal tags: [Journal, Life] ``` ## Write the scope per job Before any setup, write down each agent’s job and the tags that job needs. A plan for a company of one might look like this: ```text Agent Job Allowed tags Business invoices, follow-ups, updates Business, Client, Money, Shared Marketing posts from notes and ideas Notes, Ideas, Resources Acme Corp one design partner, nothing else Acme Corp Personal training, meals, the week Life, Shared ``` Written down, each list is short, and the journal is on no business list at all. The plan also tells you which tags every file needs, which is the part to get right first. ## The do-it-yourself options, and where each stops **Open the agent in a subfolder.** Start Claude Code, Codex or Cursor inside `business/` and it works there. That’s a sensible default, not a wall. Claude Code’s own docs are candid about it: its file tools ask before reading outside the start folder, but its read-only shell commands reach further unless you turn on a stricter setting or its sandbox. And a file saved in the wrong folder is in scope by accident. **Rules in a context file.** A line in `CLAUDE.md` or `AGENTS.md`, such as “Never read journal/.” That’s an instruction, not enforcement: Claude Code’s docs describe `CLAUDE.md` as context rather than enforced configuration. A long session, or a new model, can drift past it. **A separate folder per agent.** Business in one folder, life in another, each opened by its own agent. It’s the strongest wall you can build by hand, and it costs the most. The questions that matter cross it: whether you can take August off needs both the ledger and your plans. You also keep two structures, and files both sides need get copied and drift apart. All three draw the line by location. None of them knows what a file is. ## Tags as the boundary, done by hand If you build tag scope yourself, four rules keep it honest: - **A short, closed list of scope tags.** Business, Client, Money, Shared, Life. An invented tag is how a file slips through. - **Tag at creation.** A file with no scope tag stays out of every agent’s reach until it gets one. - **Allow lists, not deny lists.** A business agent gets Business, Client, Money and Shared. A new tag stays dark until you add it. - **Enforce it outside the agent.** Asking an agent to skip Life files is a request. A script that copies only the allowed tags into a folder, with the agent run in a sandbox or container that sees only that folder, is a boundary. That last rule is where doing it yourself gets expensive. Each agent needs its own filtered copy, rebuilt before every session, and whatever the agent writes lands in the copy, not the original. ## Where Oknola fits In Oknola, tags are the permission model, not folders ([how it works](https://oknola.com/how-it-works/)). Oknola types, tags and files what lands in the folder, so every file carries its tags from the start, and each agent gets only the tags you allow: a business agent gets your clients and your ledger, and your journal stays dark, whatever folder it sits in. Run one agent per job, each with its own tags. Agent off, your files never leave your device. Agent on, you chose the scope. In [the demo](https://oknola.com/demo/), the Business agent answers which design partner is stalling, then refuses to say how you slept, because Life is switched off. [What is available today is on the roadmap](https://oknola.com/roadmap/). ## Questions people ask ### Is a rule in CLAUDE.md enough? For low stakes, it’s a fair start. It’s still a request the agent can miss. Files that must stay private need a boundary that doesn’t depend on the agent’s attention. ### What if a file belongs to both sides? Give it a shared tag, and decide per agent whether shared is allowed. Keep that list short: a calendar and the odd receipt, not whole projects. ### Does the model provider see what the agent reads? Yes. What an agent reads goes to the model behind it, which is the best reason to scope it. In Oknola, agent off means your files never leave your device. ### Can one person run several agents? Yes, and one per job is cleanest: one for the business, one for your life, one per client, each with its own tags. [An agent for one client only](https://oknola.com/guides/ai-agent-one-client-only/) walks through the last one. Ricardo Cardona Builds Oknola, the company brain for one-person businesses. Ten years and 100+ business systems delivered for real companies. [About Oknola](https://oknola.com/about/) [How Oknola works for solo founders](https://oknola.com/use-cases/solo-founders/) Waitlist ## Start with the folder. The free app comes first, on macOS and Android. Early access opens in waves.