Give an AI agent the narrowest permissions that can complete the job. Use read-only access for inspection, approval-required access when it must make changes you want to review, and full access only for a controlled environment where unattended edits, commands, or network activity are acceptable. These labels are not universal presets: check the actual file scope, command rules, network reach and approval behavior in the product you are using.
A permission prompt is not the same thing as a security boundary. Sandboxing limits what an agent can technically reach; approval policy controls when it must pause. You need both controls, configured separately.
As an Amazon Associate I earn from qualifying purchases.
What the three permission choices actually control
An AI coding or automation agent usually combines several capabilities rather than one single permission. Before choosing a mode, examine four independent questions:
- File scope: Which directories can the agent read or write? Is it limited to the current workspace, or can it reach your home directory, source-control credentials and other projects?
- Command execution: Can it run shell commands, install packages, start services or delete files? Are commands restricted to a sandbox?
- Network access: Can tools connect to package registries, APIs, internal services or arbitrary websites?
- Approval behavior: Does every covered action pause for a person, does a policy engine decide automatically, or does the agent run without asking?
“Read-only,” “approval required” and “full access” describe useful patterns, not a cross-vendor standard. A product may expose separate switches for each axis, and two products using the same label can have very different boundaries.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Read-only or restrictive access
Read-only is a capability boundary: the agent can inspect permitted files and produce explanations, plans or patches, but writes are blocked by the execution environment. It is not a promise that every tool is disabled, nor does it automatically close the network. In Codex, the documented restrictive combination is sandbox_mode = "read-only" with approval_policy = "on-request". Confirm the exact behavior in your installed product.
Approval-required access
Approval rules decide when an action covered by policy must pause. Depending on the product, the trigger may be a write, a command outside the sandbox, network use or access to a protected path. Approval can be one-time or session-scoped. It increases human review, but it does not make an otherwise broad sandbox narrow.
Full access
Full access removes or greatly expands those restrictions. The agent may edit files beyond the workspace, run commands and use the internet without asking. The precise scope still depends on the host. Treat the phrase as a warning to inspect the actual disk and network boundary, not as a universal technical definition.
Recommended Free Tools
| Axis | Read-only / restrictive | Approval required | Full access |
|---|---|---|---|
| File changes | Normally blocked by the read-only boundary | Allowed after a covered action is approved, depending on the product | May include files outside the workspace in the named product |
| Commands and tools | Product-specific; do not assume every tool is unavailable | Approval may apply per tool or when crossing a sandbox boundary | May run without asking within the mode’s scope |
| Network | Must be checked separately from file access | May require approval or a separate network rule | Can be open in some implementations; verify the setting |
| Human review | Little intervention for reads; writes remain constrained | A person can inspect covered requests before execution | Little or no per-action review |
| Main trade-off | Safer inspection, but unable to complete many modifications | More friction with an opportunity to review consequences | More autonomy and broader potential consequences |
How sandboxing and approval work together
Sandboxing is the technical execution boundary. It can restrict writable paths, process capabilities and network reach. Approval policy is the decision point that determines when the agent asks before attempting a covered action. OpenAI summarizes the relationship directly: “Approvals and sandboxing work together.”
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For example, an agent might be unable to write outside a project directory at all; no approval prompt can grant access that the sandbox does not provide. Conversely, a sandbox might permit writes inside a broad directory while approval policy asks before each write. Neither control replaces the other.
Check network access explicitly. A read-only file setting can still allow an agent to send requests to external services if networking is enabled. Conversely, an agent may be able to edit local files while network calls are blocked. Record both settings when you document a workflow.
Choosing a mode by the task
Use read-only for inspection and planning
Choose a restrictive mode when the agent needs to answer questions rather than change the system:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute- Explain an unfamiliar codebase or configuration.
- Find references, dependency usage or likely bugs.
- Review a proposed patch that another person will apply.
- Generate a migration or test plan without executing it.
- Audit logs or documentation in a directory that must not be modified.
Ask the agent to present commands or a patch as text. If it cannot complete a task because a write is required, you can move to a temporary approval workflow rather than leaving full access enabled.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use approval-required access for supervised changes
Approval is the practical middle ground for routine development. It lets the agent edit a known workspace while giving you a checkpoint before consequential operations such as deleting files, installing packages, changing configuration or using the network. Scope approvals to the current task or session when the product supports that option, and avoid approving a broad command when a narrower command would suffice.
Reserve full access for isolated, disposable environments
Full access is appropriate only when the potential consequences are bounded: for example, a throwaway virtual machine, a container with no production credentials, or a test repository that can be restored from version control. Do not rely on the model’s intent to protect secrets. Remove unnecessary credentials, restrict outbound network paths where possible and keep backups before enabling broad access.
Current product examples
OpenAI Codex CLI
The Codex CLI documentation describes /permissions as the control for choosing what Codex may do. The CLI is designed to inspect, edit and run code, so review the permission state before starting an agent session.
OpenAI’s security guidance explains that the sandbox sets boundaries such as where Codex can write and whether it can reach the network, while approval policy determines when Codex asks. Actions outside the sandbox can receive one-time or session-scoped approval. Treat an approval as authorization for the specific scope shown in the prompt; read the command, paths and network destination rather than accepting a vague request.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Version details matter. The OpenAI Help Center notes that in Codex CLI 0.149.0 and later, along with corresponding listed desktop and Visual Studio Code extension versions, the former approval_policy = "untrusted" value is no longer supported. It names sandbox_mode = "read-only" with approval_policy = "on-request" as a restrictive alternative. Check your installed release and any managed configuration before copying this setting. See OpenAI’s version-specific guidance and its sandbox and approval explanation.
Anthropic managed agents
Anthropic’s managed-agent permission policies use three behaviors:
always_allowruns a covered tool automatically.always_askpauses for approval.autoevaluates each call and can allow, deny or pause.
The documentation is explicit that “auto is not a human checkpoint.” A call judged safe can run before anyone sees it; a high-risk call can be denied, and an uncertain one can pause. These policies apply to the managed-agent platform. Built-in agent and MCP toolsets are distinguished from custom tools executed by the host application, so verify which tool category your integration uses.
Free tools Windows power users keep installed
One-click scans. No signup required.
Visual Studio Code Agent Host
Microsoft’s Agent Host documentation describes experimental Codex Agent Host presets:
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Preset | Documented behavior | Best fit |
|---|---|---|
| Default Permissions | Reads and edits workspace files and runs routine local commands; asks before internet use or access outside the workspace | Supervised work in one repository |
| Auto-Review | Sends approval requests to an automatic reviewer | Workflows where policy evaluation, rather than a person, handles routine requests |
| Full Access | Allows edits outside the workspace and internet access without asking; the page cautions that it gives unrestricted disk and network access | Only an isolated environment with deliberate risk acceptance |
These descriptions apply to the Agent Host surface marked experimental, not automatically to every Codex integration in Visual Studio Code.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to configure permissions safely
- Write down the task boundary. Name the repository or directory, required commands, expected outputs and whether network access is genuinely needed. If you cannot describe the boundary, do not enable full access.
- Start in read-only mode. Let the agent inspect the project and produce a plan. This reveals missing dependencies and the files it wants to touch without permitting changes.
- Set the sandbox separately. Restrict writable paths to the project or a disposable workspace. Decide whether network access is off, allow-listed or open. Remember that file and network controls are independent.
- Choose the approval policy. Use on-request or an equivalent human gate for writes, boundary crossings and network calls. If the product offers automatic evaluation, treat it as policy automation, not human review.
- Run a harmless test. Ask the agent to read a file, create a proposed patch without applying it, and report whether a network call would be permitted. Confirm the observed behavior matches the settings.
- Approve narrowly. Inspect the exact command, paths, arguments and destination. Prefer a single package install or test command over a shell expression that chains several operations.
- Review the result and revoke excess access. Check the diff, generated files, processes and network activity. Return the session to read-only or end it when the task is complete.
Common mistakes and how to fix them
Assuming read-only also blocks the internet
Symptom: The agent cannot save a file but can still contact external services. Fix: Inspect the network setting separately and disable or allow-list it when source code or credentials must remain local.
Treating a prompt as a sandbox
Symptom: You approve actions but the agent can already see or modify a directory broader than intended. Fix: Narrow the sandbox first. Approval should govern exceptional actions inside a deliberate technical boundary, not compensate for an oversized one.
Confusing automatic review with a person
Symptom: An “auto” or “automatic reviewer” mode runs a call you expected to inspect. Fix: Read the policy semantics. Automatic evaluation may allow safe calls before a human sees them; choose an always-ask or on-request policy for genuine human checkpoints.
Copying an obsolete setting
Symptom: A configuration value is rejected after an upgrade. Fix: Check the product’s release notes and managed policy. In current Codex guidance, the old untrusted approval policy is unsupported in the specified newer versions; use the documented read-only and on-request combination where appropriate.
Granting full access to protect productivity
Symptom: The agent completes tasks quickly but can alter unrelated files, install software or exfiltrate data. Fix: Move the work to a disposable environment, remove credentials, restrict network paths and return to approval-required access. Speed is not a substitute for a bounded failure mode.
A practical decision rule
Ask what the agent must do, not what label sounds convenient. If it only needs to observe, choose read-only. If it must change a controlled workspace and you want to inspect consequential actions, choose approval-required with a narrow sandbox. If it must operate unattended across files and networks, use full access only inside an isolated, recoverable environment and verify exactly what “full” means in that host.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
