AI agent sandbox permissions

Choose sandbox permissions for AI coding agents so they can work without destructive commands or unsafe external access.

Quick answer

Give agents the lowest permission level that still lets them complete the task. Escalate only for commands that are necessary and understood.

Separate read access, write access, network access, shell commands and deployment actions. Each layer needs a reason.

Never treat convenience as a reason to allow destructive commands, broad secrets access or production writes.

Only in very controlled workflows with explicit human intent, auditability and rollback paths.