<?xml version="1.0" encoding="UTF-8"?><oembed><type>video</type><version>1.0</version><html>&lt;iframe src=&quot;https://www.loom.com/embed/dd05b295aff04769bdfa99782dd4c418&quot; frameborder=&quot;0&quot; width=&quot;1108&quot; height=&quot;831&quot; webkitallowfullscreen mozallowfullscreen allowfullscreen&gt;&lt;/iframe&gt;</html><height>831</height><width>1108</width><provider_name>Loom</provider_name><provider_url>https://www.loom.com</provider_url><thumbnail_height>831</thumbnail_height><thumbnail_width>1108</thumbnail_width><thumbnail_url>https://cdn.loom.com/sessions/thumbnails/dd05b295aff04769bdfa99782dd4c418-3d7d6c63dfea62e9.gif</thumbnail_url><duration>328.541122</duration><title>OneCLI - OSS sandboxed agent harness for teams</title><description>This Loom demonstrates an open source CLI sandbox agent harness that lets teams run separate employee or colleague agents with controlled permissions. It shows agents like Donna communicating via Slack and web through a gateway, including viewing requests and responses and checking items such as emails over the last 24 hours. The video explains how agents are sandboxed and how missing app credentials lead to a 401, prompting the user to connect before retrying. It also covers permission guardrails that require deterministic approval before sensitive actions like sending an email.</description></oembed>