Permissions, sandboxes and first-session setup

What it isCopy Anchor Link

Every coding agent has a permission system. Reading files is usually allowed. Running a command or editing a file asks you first. You can allow some actions for good, such as running your tests, and block others, such as deleting files or pushing to the main branch. A list of actions that are always allowed is an allowlist. The idea behind all of it is least privilege: give the agent only the access the job needs.

A sandbox goes one step further. It is a restricted space, such as a container or a separate checkout of the repo, where the agent can act freely because a mistake there cannot reach your real files, other projects or secrets.

Your first sessionCopy Anchor Link

Work through this list once, before any real task.

1. Open the agent in one project folder, not your whole home directory.
2. Start on a new git branch or worktree, so every change can be thrown away.
3. Keep approvals on for commands. Allow only safe, repeatable ones (tests, linting, reading git history).
4. Keep secrets out of reach: no .env files, keys or production credentials in the folder the agent can read.
5. Write down in the memory file what must never be done, such as "never run migrations on production".

A worked example: sorting commandsCopy Anchor Link

You ask the agent to fix a failing test. It wants to run seven commands. Allow npm test and git diff for the rest of the session, because they only read or check. Approve npm install lodash once after looking at the package. Refuse rm -rf build unless you read the path, and refuse git push --force outright. Four commands never interrupt you again, one needed a decision, two were blocked. That is a few seconds of attention instead of a prompt on every step.

How the approval check worksCopy Anchor Link

Before the agent runs a command or edits a file, the harness, the program that wraps the model, compares the request with your rules. A rule can allow it, block it, or ask you. The model does not decide this. That is the point: the check is ordinary code, so a clever prompt cannot talk its way past it. A sandbox adds a second layer, enforced by the operating system or a container, so even an approved command is limited to a small area.

A second example: where approvals are not enoughCopy Anchor Link

The agent reads a web page to learn about a library. Hidden in the page is a line telling it to send your files to an address. This is prompt injection: text from outside that tries to give the agent orders. Your approval prompt may catch an obvious command. A harmless-looking command could still pass. A sandbox with no secrets inside and no network access to unknown sites limits the harm even if you click yes. Permissions reduce mistakes. Isolation limits the damage from the ones that slip through.

Trade-offsCopy Anchor Link

More prompts mean more safety and more interruptions. After the fifth identical question, people start clicking yes without reading, which defeats the system. Allow narrow, repeatable commands so the prompts that remain are rare enough to read. Broad rules, such as allowing any command that starts with a common word, can include dangerous cases, so keep them specific.

What goes wrongCopy Anchor Link

Look for these symptoms. The agent stalls on a prompt you did not see because it is in another window. A command is blocked, and the agent tries a workaround that you did not intend. A change lands on the wrong branch because you forgot to switch. To confirm, read the log of commands the tool ran and check your branch name before starting.

Try it yourselfCopy Anchor Link

Create a throwaway folder with a git repository and one small file.

1. Ask the agent to read the file and add a comment.
2. Approve the edit and view the diff.
3. Ask it to delete the file, and decline.
4. Restore with git if anything changed.

Expect to see exactly what it asked and be able to undo it.

Common mistakeCopy Anchor Link

Turning off all approvals to go faster, in a folder that contains secrets or production access. The speed is real, and so is the damage when the agent follows a bad instruction hidden in a web page or a file.