For AI agents: The documentation index is at https://docs.digitalocean.com/llms.txt. Markdown versions of pages use the same URL with index.html.md in place of the HTML page (for example, append index.html.md to the directory path instead of opening the HTML document).

Contract review, vendor questionnaires, and policy checks are pattern matching against a checklist, and an agent is good at a first pass. What makes this different from the earlier examples is not the work, it is the constraints: the material is sensitive, so the environment should be able to do almost nothing except read it and write a summary.

This example is the locked-down pattern. It produces a reviewer’s first pass, flagging clauses for a human to decide on. It does not decide anything, and it is not a substitute for advice from a qualified professional.

Environment Spec

Save the following as document-review.yaml:

name: contract-review
agent: claude-code
size: mars-2vcpu-4gb
persistent_workspace: false
idle_timeout: 15m
repos:
  - your-org/contracts
env:
  HARNESS_INFERENCE_MODEL: anthropic-claude-5-sonnet
secrets:
  HARNESS_INFERENCE_API_KEY: ${HARNESS_INFERENCE_API_KEY}
  GITHUB_TOKEN: ${GITHUB_TOKEN}
egress:
  - github.com
  - api.github.com
skills:
  - name: clause-checklist
    description: "Use when reviewing any inbound contract, order form, or vendor agreement."
    instructions: |
      # Clause Checklist

      For each document, report on every item below. Say "not present"
      explicitly rather than staying silent, because a missing clause is
      usually the finding.

      - Governing law and venue
      - Limitation of liability, and whether it is mutual
      - Indemnity scope
      - Auto-renewal and the notice window to prevent it
      - Data processing terms and subprocessor consent
      - Assignment on change of control

      Quote the clause text you are describing. Flag anything that departs
      from our standard position; do not decide whether to accept it.
permissions:
  default: deny
  filesystem:
    mode: workspace-write
  rules:
    - tool: file.read
      action: allow
    - tool: file.write
      action: allow
    - tool: bash
      action: allow

Three things are doing the security work here, and each is worth keeping if you adapt this.

default: deny inverts the usual posture. Anything not named in a rule is blocked, so attaching a tool to the environment later does not silently grant the agent the ability to use it.

bash is allowed, and that is the honest cost of cloning. There is no separate clone permission; the agent clones by running git in a shell. Allowing bash also means there is no push control left to apply: no adapter currently implements a git.push permission target, so a shell is a shell. Plan for the agent being able to reach anything the network policy permits.

egress lists only GitHub. The platform adds the hosts the session cannot run without, including the DigitalOcean inference endpoint, and nothing else is reachable. The documents arrive from a private repository, so a prompt injection that tells the agent to post the text somewhere has nowhere to post it. Treat this as shrinking the blast radius rather than as an airtight boundary: an agent with bash and a route to GitHub can still write to GitHub.

persistent_workspace: false means the checkout does not survive. Combined with removing the session when the review is done, the documents do not sit in a warm sandbox between runs.

Run It

export HARNESS_INFERENCE_API_KEY=<your-model-access-key>
export GITHUB_TOKEN=<your-github-token>

doctl harness-runtime launch --spec document-review.yaml \
  --prompt "Clone your-org/contracts and review every file under inbound/2026-q3/. Produce one summary per document at review/<filename>.md."

Read the summaries in the session, then tear the environment down:

doctl harness-runtime remove contract-review

For what DigitalOcean retains from a session and for how long, see Managed Agents Data Privacy. The document text also reaches the model, so check the retention terms of the model you name in HARNESS_INFERENCE_MODEL before you review anything sensitive. A few third-party models on Serverless Inference carry mandatory retention, which is listed per model in Available Models and explained in Inference Data Privacy.

Adapt It

Related

• Permission Policies for how a deny default interacts with rule order and adapter support.
• Network Egress for what an allowlist does and does not cover.
• Secrets and Configuration for keeping credentials out of the guest environment.