Docs
Overview
A company installs Occlude in its own cloud. Occlude holds the full clone. Contractors and AI agents work through it, never from a copy.
On the way through, the runtime decides what each party can see. Files they are not allowed to read are still present for the compiler, the test runner and the dev server, so everything builds, runs and tests exactly as it would for a full-access engineer. When the engagement ends, the contractor's laptop holds nothing, and the company holds a record of every file every person and agent touched.
These pages describe Occlude as designed. Each page carries a label at the top. Available means observed working on our fixture repository. In build means the work has started. Planned means it has not. Access starts with a call, which is where the timeline for your team comes from.
Vocabulary
| Term | Meaning |
|---|---|
| Occlusion layer | The runtime mechanism that presents a filtered tree to one channel and the full tree to the other |
| Occlusion profile | A reusable, named permission set, generated from observation, used as a template for task grants |
| Visible | Readable and writable |
| Read-only | Readable, not writable |
| Occluded | Exists for the build. Absent to the person. The signature resolves; the body does not |
| Absent | Not mounted in the runtime at all. Never in memory |
| User channel | The person's side: their shell, editor server, language server and anything they start. It sees the occluded view |
| System channel | The build's side: the compiler, test runner and dev server. It sees the real tree, minus Absent paths |
| Door | Any client attached to the user channel: the browser workspace, VS Code over SSH, a terminal, an MCP server |
| Task grant | A time-boxed permission set bound to one unit of work, revoked when it ends |
What Occlude is not
| Not | Because |
|---|---|
| An IDE | The browser workspace is one door. Any editor attached to the user channel is a door, so a better editor is not a competitor |
| A plugin or an endpoint agent | A boundary the constrained person can uninstall is not a boundary. The company installs Occlude, not the developer |
| A filter on agent tool calls | A compiler's read is the same syscall as a contractor's, so a filter on tool calls cannot keep a file from the person and keep tsc green |
| A container host | E2B, Modal and Daytona isolate the box. Occlude compartments inside it |
| A version-control feature | Perforce can exclude a file at sync time, and the build breaks because the file is not on disk. Perforce controls what syncs. Occlude controls what runs |
Where to start
- Concepts: the occlusion layer, the two channels, profiles, grants, sessions and doors on one page.
- The four states: what every file operation returns, state by state.
- Profiles: the format the runtime accepts, with a worked example.
- Security model: the vectors, the memory-dump problem and what we do not claim.
- Install: the designed installation into your Kubernetes.