iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Give an AI coding agent enough access to inspect the project and complete the requested change, but no more: read the active repository, write only inside its workspace, keep secrets and unrelated files out of reach, and require approval for privilege expansion, destructive actions, new network destinations, and external side effects such as pushing or publishing.
“Allow the agent” is not one permission. Filesystem paths, shell execution, network egress, credentials, external integrations, and approval rules are separate controls. Configure each one for the task, then inspect the diff and test results before you commit or merge. Product defaults differ by agent, operating system, edition, and organization policy, so verify the effective session policy instead of relying on a remembered default.
The practical permission baseline
For an ordinary feature, bug fix, or refactor in a trusted repository, start with this profile:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute- Project files: permit reading the repository and writing within the active workspace roots.
- Shell and tools: enable the commands needed to build, test, lint, or format; put destructive commands and system-wide changes behind approval.
- Network: leave outbound access off when the task does not need it. If package downloads or documentation lookups are required, allow only the necessary destinations when the product supports destination controls.
- Credentials: do not expose broad personal, cloud, source-control, or production tokens. Use scoped credentials, a credential proxy, or masking facility where available.
- Approvals: ask before accessing sensitive paths, expanding the sandbox, contacting a new host, deleting or overwriting significant data, or creating an external side effect.
- Review: inspect the complete diff, run relevant tests, and check tool or integration changes before committing, merging, pushing, or opening a pull request.
This is a least-privilege starting point, not a universal preset. A deployment task, a monorepo spanning several roots, or an offline build may justify a narrow exception. Record what was added, keep it session-scoped where possible, and remove it when the task ends.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why permissions must be split into separate controls
| Control | Question to answer | Safer default |
|---|---|---|
| Filesystem | Which directories may the agent read, create, modify, or delete? | Read the project; write only in active workspace roots; deny secrets and unrelated repositories. |
| Execution | Which processes and commands can it start, and can children inherit access? | Permit build and test tools; approve privileged, destructive, or system-wide commands. |
| Network | Can it reach the public internet, private networks, or both? | Off unless needed; separate public egress from local or private-network access. |
| Credentials | Which tokens, keys, and environment variables can processes see? | None by default; use narrowly scoped, masked, or proxied credentials. |
| Integrations | Can MCP servers, extensions, language servers, or scripts act outside the workspace? | Review their source and configuration before trusting them. |
| Approval and audit | What requires a human decision, and what actions are logged? | Explicit approval for boundary crossings; inspect changes and policy events. |
A prompt asking for confirmation is not the same as a technical boundary. An approval policy decides when a human must authorize an action; a sandbox limits what the process can technically do. Use both where available. A user can accidentally approve a dangerous operation if the sandbox leaves broad access available, while a restrictive sandbox can block a necessary operation even when the user intends to allow it.
Filesystem permissions: contain the working area
Grant workspace-limited writes
Allow the agent to read source files, configuration needed for the task, and local test fixtures. Permit writes in the active repository and its explicitly required workspace roots. Do not grant blanket access to your home directory, every repository on the machine, cloud-synchronised folders, SSH directories, browser profiles, or backup volumes merely because the agent might eventually need them.
Workspace-limited tools are documented by Visual Studio Code, and GitHub Copilot CLI documents writes to the current working directory and temporary folders by default, with other paths blocked unless access is granted. These are product behaviours, not a promise that every agent uses the same roots.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Protect high-value paths
Keep .env files, private keys, credential stores, signing certificates, production configuration, customer exports, and unrelated repositories outside the allowed roots whenever possible. If a task genuinely requires one file, expose a sanitized copy or a narrowly scoped path rather than the whole directory. Remember that read permission alone can disclose secrets: an agent can copy, summarize, or encode a value without modifying the file.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Account for temporary files and child processes
Build systems often write caches, generated files, and logs outside the repository. Add only the specific temporary directory or cache root needed. Check whether the sandbox applies to child processes, language servers, test runners, and MCP servers; an apparently harmless tool can otherwise become the route around the intended file boundary.
Shell and command execution
Permit routine development commands
Most coding tasks need a package manager, compiler, test runner, formatter, or version-control client. Approve these tools according to the repository’s documented workflow. Keep auto-approval limited to predictable, non-destructive commands and make the rule session-scoped. VS Code warns that command parsing for auto-approval is best-effort and has limitations, so a rule that looks safe on paper should not be treated as a complete security boundary.
Require approval for high-impact commands
Put explicit confirmation in front of commands that delete or overwrite broad paths, change system packages or services, alter firewall or identity settings, rewrite history, rotate credentials, deploy infrastructure, or push to a remote. Treat shell interpolation, downloaded scripts, and commands that execute generated content as high risk even when the visible command appears short.
Use a disposable environment for risky work
For untrusted code, use a container, virtual machine, or isolated development account in addition to the agent’s own sandbox. Sandboxing is an extra layer, not a virtual machine, user-account boundary, or replacement for endpoint security. The host account’s permissions still matter: an agent running as your user may inherit access to anything that user can access unless the operating-system boundary blocks it.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Network access is an independent decision
Do not infer network behaviour from filesystem settings. An agent may be unable to write outside the workspace yet still reach external hosts, or it may have no internet while retaining access to local services. Decide separately whether the task needs package registries, documentation, a code-host API, an internal artifact store, or a private service.
Prefer no egress when it is unnecessary
Offline operation reduces data-exfiltration and supply-chain opportunities. If dependencies are already cached and the task is local, disable network access. When access is required, allow only the domains or services needed and distinguish public internet from local or private-network access.
Know the documented defaults
GitHub Copilot CLI documents outbound internet as on by default in its local sandbox while local-network access is off. NERSC’s Codex guidance describes workspace-write with network access off unless it is enabled. The difference shows why a product name alone is insufficient: platform, policy, and profile determine the effective setting.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Review downloaded content
Network permission allows more than a package download. It may permit retrieval of scripts, prompts, archives, or remote instructions that influence subsequent commands. Pin dependencies where practical, inspect install scripts, and do not approve a new host simply because a tool claims it is required.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Credentials and secrets
Do not pass broad tokens into the session
A personal access token with repository-wide write access, a production cloud key, or an unrestricted database password gives an agent consequences far beyond editing code. Prefer a token limited to the single repository and operation, a short-lived credential, a read-only account, or a dedicated test environment. Never assume that hiding a value in an environment variable makes it invisible to every process the agent can start.
Use mediation when available
GitHub documents placeholder credentials in sandboxed commands: real values can be supplied only for approved HTTPS destinations, and additional environment variables can be masked. Treat this as product-specific behaviour. Confirm which commands, child processes, MCP servers, and language servers receive the real value, and check whether logs, error messages, or generated files can expose it.
Design for accidental disclosure
Before starting, remove unnecessary secrets from the workspace and rotate any credential that may have been printed or committed. Ask the agent to avoid including secret material in patches, test output, or issue text, but enforce the boundary technically as well. A prompt is guidance; path restrictions, masking, and scoped credentials are controls.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Approvals and sandboxing: use both
OpenAI describes approvals and sandboxing as complementary: the sandbox controls where Codex can write, whether it can use the network, and which paths are protected, while approval policy controls when it asks to act outside that boundary. Centrally managed requirements and agent-aware event telemetry may exist in organization deployments, but individual defaults must be checked in the current settings.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Approval gates should cover five categories:
- Permission expansion, such as adding a directory, enabling network access, or disabling a sandbox.
- Access to sensitive files, credentials, private services, or unrelated repositories.
- Destructive or difficult-to-reverse operations.
- New external destinations or downloaded executables.
- External side effects, including pushes, releases, ticket updates, messages, and production changes.
Keep an exception narrow: specify the path, host, command, and duration. Reject a vague request such as “allow everything for setup” and ask what exact operation failed and why it needs broader access.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Repository trust and external integrations
Treat project instructions as executable influence
README files, contribution guides, build scripts, editor tasks, hooks, extensions, and generated configuration can instruct an agent to run commands or reveal data. In an unfamiliar repository, begin in a restricted or read-only mode, inspect those files, and approve only the steps you understand.
Review MCP servers and extensions
An MCP server or extension may read files, call services, or perform actions outside the editor. Verify its source, requested scopes, network destinations, and update mechanism. Review repository-provided MCP configuration before enabling it; do not assume that a server inherits the same restrictions as the core agent.
Use restricted mode for untrusted projects
VS Code recommends Restricted Mode for untrusted projects, agent sandboxing, review of changes before integration, and session-scoped auto-approval. Its guidance also stresses that sandboxing is not a standalone security boundary. Apply the same caution to copied repositories, generated examples, and code supplied by unknown contributors.
Quick Recap
What documented products illustrate
| Product or environment | Documented permission details | How to interpret them |
|---|---|---|
| OpenAI Codex | Approvals and sandboxing are separate controls for writes, network use, protected paths, and actions outside the boundary; organization-managed requirements and telemetry may apply. | Check the current personal or organization policy rather than assuming centrally managed settings. |
| GitHub Copilot CLI | Local sandboxing restricts files, network resources, and credentials. Documented defaults allow writes in the current directory and temporary folders, outbound internet is on, local network is off, and credential mediation is used for approved HTTPS destinations. | Platform prerequisites and enterprise policy can change the effective behaviour. |
| Claude Code | An Anthropic engineering article dated October 20, 2025 described read-only-by-default operation, prompts before modifications or commands, safe-command exceptions, and a beta sandbox preview with filesystem and network isolation. | The preview status is time-sensitive; verify availability and current defaults before relying on it. |
| Visual Studio Code | Documentation recommends Restricted Mode for untrusted projects, agent sandboxing, reviewed changes, session-scoped auto-approval, and review of MCP servers. Agent tasks otherwise operate with the user’s permissions. | Protect the host account and injected credentials; auto-approval parsing is not perfect. |
| NERSC Codex on Perlmutter | read-only supports inspection without filesystem changes; workspace-write permits routine writes in active workspace roots and temporary directories with network off unless enabled; danger-full-access removes local sandbox restrictions. |
These are NERSC operational profiles, not universal Codex settings. |
A step-by-step setup before the first prompt
- Classify the repository. Mark it trusted, internal, or untrusted; identify production configuration, customer data, private keys, and required external services.
- Define workspace roots. Select the exact repository and any required temporary or generated-file directories. Exclude home-directory-wide and unrelated paths.
- Choose execution mode. Start read-only for inspection or unfamiliar code. Select workspace-write only when edits are required. Reserve unrestricted modes for a disposable environment and a specific, understood need.
- Set network policy. Disable egress for local work. If dependencies or APIs are required, list the destinations and decide separately whether private-network access is allowed.
- Prepare credentials. Remove unnecessary secrets; create scoped, short-lived credentials for the exact service and operation. Enable masking or proxying if offered.
- Configure approvals. Require confirmation for boundary expansion, sensitive paths, destructive commands, new hosts, and external side effects. Keep automatic approvals narrow and temporary.
- Inspect integrations. Review MCP servers, extensions, hooks, scripts, and language-server configuration before enabling them.
- Run a harmless probe. Ask the agent to list the workspace, report its effective mode, and perform a read-only test. Confirm that an out-of-scope path and a blocked network request are denied.
- Work in small changes. Ask for one coherent change at a time, inspect tool calls and generated files, and stop if the agent requests a permission unrelated to the task.
- Verify before integration. Run tests and security checks, inspect
git diffandgit status, review new dependencies and configuration, then commit or publish only after a human approves the result.
Adjustments for common tasks
| Task | Additional access that may be justified | Controls to retain |
|---|---|---|
| Documentation or code explanation | Read-only project access; usually no shell or network. | Protect secrets and unrelated paths. |
| Local bug fix | Workspace writes and approved test commands; temporary build-cache access if required. | No production credentials; network off unless dependencies are missing. |
| Dependency update | Package-registry access to named hosts and permission to modify lockfiles. | Review install scripts, versions, checksums, and the complete diff. |
| Database or API integration | Access to a test endpoint with a scoped test credential. | Keep production endpoints and data inaccessible; approve each new host. |
| Deployment preparation | Read deployment configuration and, if necessary, a dry-run command. | Require separate approval for applying changes, publishing, or contacting production. |
| Untrusted repository analysis | Read-only copy in an isolated account or disposable environment. | Restricted mode, no secrets, no network until inspected, and no automatic command approval. |
How to diagnose a permission failure safely
- Read the denial precisely. Identify whether the blocked resource is a path, command, host, credential, or integration.
- Ask whether it is necessary. Many agents request broad access when a narrower path, cached dependency, or read-only alternative would work.
- Prefer a scoped workaround. Copy sanitized input into the workspace, use a test service, allow one destination, or grant one command for one session.
- Re-test the boundary. After changing policy, verify both the intended operation and that unrelated paths, hosts, and secrets remain blocked.
- Revoke the exception. Remove temporary paths, hosts, and credentials when the task is complete, then inspect logs and the final diff.
Final review checklist
- The agent could reach only the repository and explicitly required temporary roots.
- Sensitive files, production systems, and unrelated repositories were inaccessible.
- Network access was either disabled or restricted to named, necessary destinations.
- Credentials were absent, scoped, masked, or proxied, and no logs or generated files contain them.
- Destructive commands, privilege expansion, and external side effects required approval.
- MCP servers, extensions, hooks, and project scripts were reviewed.
- The diff, tests, dependency changes, and configuration changes were examined by a human.
- Temporary exceptions and credentials were revoked after the task.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
