Permission safety for AI coding agents

The risk of a coding agent is not limited to incorrect code. It includes which files the agent can read, which networks it can reach, which credentials it can use, which MCP tools it can call, and which actions need no human confirmation. Prompt injection can hide in a repository, issue, web page, or tool output. Telling an agent “do not leak secrets” is not an enforceable boundary. As of 2026-07-29, OpenAI's Codex security material treats sandboxing, approvals, and internet access as separate controls. Anthropic documents Claude Code security and permissions. The MCP security guide warns that local MCP servers run with the client's user privileges and recommends restricting filesystem and network access with minimal scope. Configuration must follow a threat model, not copy an “unrestricted” flag. Implementation steps Classify work. Level 0 reads and explains code. Level 1 edits inside a recoverable workspace and runs tests. Level 2 installs dependencies, reads the network, or drafts migrations. Level 3 pushes, messages people, writes production, deletes cloud resources, moves money, or rotates secrets. The first two can be automated in a constrained workspace. Level 3 needs a resolved target, fresh read, and explicit confirmation. Give the filesystem sandbox one repository or worktree and required temporary paths, not home directories, SSH, cloud configuration, or browser profiles. Keep network off by default or allow official documentation and package registries. When browsing untrusted content, separate that environment from any runner holding credentials. Keep credentials behind the provider or runner boundary, outside agent context. CI can use short-lived OIDC or environment secrets released only to a protected job. Do not give a general development agent a database publisher key in .env . Wrap privilege in a narrow operation such as “upsert this exact draft allowlist,” not arbitrary SQL. permissions: contents: read jobs: verify: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: npm ci && npm test deploy: needs: verify environment: production permissions: contents: read id-token: write Gate the action, not the agent's verbal description. Preapprove local, reversible edits. Require approval for a new network domain, a write outside the workspace, destructive commands, and remote mutations. Approval UI should display the resolved target, command or API, scope, and recoverability; reject wildcards. Maintain an MCP and tool inventory with owner, transport, credential, read/write classification, data type, and approval mode. Enable only the servers and tools needed for the current task. Separate read and write capabilities. The tool server enforces its own authentication and authorization instead of assuming a host confirmation exists. Add a repository contract listing build and test commands, protected paths, generated files, secret patterns, and remote policy. Pre-commit and CI run secret scanning, dependency checks, typing, tests, and builds. Hooks are supporting controls, not a replacement for the sandbox. Audit task, actor, commit or diff, tool/action, resolved target, approval decision, and outcome while excluding secrets, tokens, and full sensitive content. Before a high-risk action, create a backup or checkpoint; afterward, perform a remote read or live verification. Failure and recovery If the agent reads a secret it should not access, stop the session, revoke or rotate the credential, inspect logs, transcripts, and artifacts for exposure, then narrow the sandbox. Adding the file to .gitignore does not revoke an exposed secret. If untrusted text induces a tool call, disable the connector or capability, preserve the injection input and audit, and inspect every side effect. Do not rely on the final assistant statement that nothing happened. Repair tool allowlists, argument validation, and approval gates. For an accidental workspace edit, use git diff to isolate agent-owned changes, preserve pre-existing user work, and revert only the owned patch or commit. For a remote push or database write, use the pre-write backup and provider audit. Avoid force pushes and broad deletes that expand the incident. When approvals create too much friction, combine safe, reversible, narrowly scoped local actions into reusable rules instead of switching to unrestricted mode. For unattended work, expose a narrow service wrapper under deny-by-default policy. Verification commands git status --short git diff --check git grep -nE '(SERVICE_ROLE|PRIVATE KEY|api[_-]?key)' -- ':!*.md' npm test Canary the sandbox: reading outside the workspace fails, unallowlisted network access fails, remote writes are gated, an MCP write tool without scope is denied, and secrets never appear in stdout or logs. Rehearse a denied approval, tool timeout, and rollback, proving each path fails closed. Primary sources OpenAI Codex Security Anthropic Claude Code security MCP Security Best Practices Internal links Browse technical articles for MCP servers and repository workflow. Practice a constrained agent pipeline through the course catalog . Send a redacted security timeline through the contact page .