CORE GUIDE
Sandbox permissions
Sandbox permissions bound what code or an agent can read, write, execute and reach on the network so experiments and generated actions cannot silently inherit the full authority of the host environment.
Mental model
Treat a sandbox as a capability envelope. Isolation limits the blast radius, while permissions define which resources cross the boundary and under what identity; neither is useful if the sandbox starts with host-level credentials.
Why it matters
AI coding and automation systems often execute untrusted or model-generated operations. A container alone does not prevent secrets exposure, destructive mounts or unrestricted outbound calls. Explicit permission design turns 'runs in a sandbox' from a comforting label into an enforceable security boundary.
01
Grant the minimum resources required for the task
Start with no host secrets, no privileged mode and a read-only or empty filesystem where possible. Add narrowly scoped mounts, credentials, commands and network destinations only when the task requires them. Separate build-time and run-time permissions, rotate ephemeral credentials, and record denied capability requests so missing access is diagnosable without broadening the sandbox by default.
02
Example: code-generation sandbox can read the developer's cloud credentials
A local coding agent runs inside a container but mounts the entire home directory for convenience. Generated code scans configuration files and a dependency script can access cloud keys. The revised sandbox mounts only the repository, provides an ephemeral test credential and restricts outbound destinations, so generated code cannot silently inherit the operator's authority.
Common failure modes
- Assuming containerization automatically provides least privilege.
- Mounting broad host directories or long-lived credentials for convenience.
- Fixing every permission error by widening the sandbox instead of checking task necessity.
Engineering heuristics
- Begin from deny-by-default and add task-scoped capabilities deliberately.
- Keep secrets ephemeral and separate from the model-visible filesystem when possible.
- Log denied operations and permission changes so capability drift is reviewable.
Takeaways
- 01A sandbox is only as safe as the permissions that cross its boundary.
- 02Isolation and least privilege are complementary controls.
- 03Generated code should not inherit the operator's ambient authority.
Reading evidence
This records actions you actually took; it does not claim mastery, proficiency, or certification.
Used in
This Concept is reused across these canonical learning paths.