AI agent sandbox permissions
Choose sandbox permissions for AI coding agents so they can work without destructive commands or unsafe external access.
Quick answer
Give agents the lowest permission level that still lets them complete the task. Escalate only for commands that are necessary and understood.
Permission model
Separate read access, write access, network access, shell commands and deployment actions. Each layer needs a reason.
Risk check
Never treat convenience as a reason to allow destructive commands, broad secrets access or production writes.
FAQ
Should agents get production write access?
Only in very controlled workflows with explicit human intent, auditability and rollback paths.
Design safe permissions
Related guides
Claude Code Agents: When to Use Them
Claude Code Agents (subagents) let you spawn isolated work threads from the main session. Full guide: what they are, when to use them, how to write a custom one, and the patterns that actually ship.
Claude Code is great when you're driving one thread of work. When you need to run three threads in parallel, or want a fresh pair of eyes on a decision, or need to scope out a large refactor without polluting your main session that's what Agents are for. This is what Claude Code Agents actually are, when to use them, and how to write your own. What Claude Code Agents actually are An Agent (sometimes called a subagent) is an isolated work thread you spawn from the main Claude Code session via the Agent tool. It has its own context fresh, with no visibility into your conversation. You hand it a self contained prompt; it does the work; it returns a single message at the end. Three things make this different from just asking Claude another question: 1. Isolated context. The agent doesn't see what you've been doing. It can't…
Read the guide5 Claude Code Hooks I Use Daily
Claude Code hooks run shell commands on session start, file writes, and tool calls. Here are the 5 I use daily and how to configure them.
Most people discover Claude Code for the AI. They miss the hooks. Hooks are shell commands that execute automatically when something happens in your Claude Code session: a session starts, a tool runs, Claude stops. You define them in .claude/settings.json . They run silently in the background. Here are the 5 I use every day. What hooks look like The available events: SessionStart , UserPromptSubmit , PreToolUse , PostToolUse , Stop . Hook 1 Auto inject date on every prompt Event : UserPromptSubmit Claude doesn't have real time awareness. Every prompt gets the current date injected automatically. Useful for anything time sensitive: changelogs, deadlines, scheduling logic. Hook 2 Push notification when Claude stops Event : Stop Long tasks (refactors, test runs, analysis) can take 2–5 minutes. Without a notification I'd either stare at the screen or miss the result. This fires whenever Claude finishes a task, whether it succeeded or…
Read the guideClaude Code MCP: Connect Servers & Tools
Claude Code MCP (Model Context Protocol) lets you plug external tools and data into Claude. Full guide: how to add an MCP server, list available ones, and the patterns that work.
A Claude Code conversation can only do so much with the tools shipped in the box. The moment you want Claude to touch Notion, Stripe, your AWS account, a specific database you need MCP. MCP (Model Context Protocol) is the standard that connects Claude to external tools. Here's what it is, how to add servers, and the patterns that don't waste your time. What MCP actually is MCP is an open protocol. A small server process (the "MCP server") exposes a set of tools. Claude Code (the "MCP client") talks to it over stdio or HTTP. When Claude needs to call one of those tools, it sends a JSON RPC request; the server runs the function and returns the result. Three pieces: MCP server the process that exposes tools. Usually npx installable. Examples: filesystem, GitHub, Notion, Stripe, Postgres. MCP client Claude Code itself. It manages connections, surfaces tools to the…
Read the guide