File permissions and sandbox boundaries limit an AI agent only where an enforcement layer actually applies them to the process doing the work. Approval prompts decide when a person is asked to sign off. Undo features restore only the state they track. None of the three reverses everything an agent can do, and most unpleasant surprises happen in the gaps between them.
Prevention, approval, and recovery answer different questions
People often lump these controls together under the word “permissions.” They do different jobs, and each one stops a different kind of problem.
As an Amazon Associate I earn from qualifying purchases.
| Control | Question it answers | What it can do | What it cannot do |
|---|---|---|---|
| File permissions and OS-level sandbox | What can the process read, change, or reach? | Block access outside the directories, files, and network destinations the enforcement layer covers | Stop harmful actions inside the granted boundary, or reach anything the boundary does not cover |
| Approval policy | When does a person get asked? | Pause an action that would cross a configured boundary so someone can review it | Shrink the access that already exists, or guarantee the reviewer understood what they approved |
| Checkpoints and rewind | What can be rolled back? | Restore tracked workspace files and, in some products, chat history | Reverse terminal commands, network requests, deployments, or changes in external services |
| Git history | What has been committed? | Recover earlier committed versions of project files | Recover anything that was never committed, or any effect outside the repository |
The practical rule: a sandbox decides what the agent can touch, an approval decides whether a particular action proceeds, and undo decides what can be walked back afterward. Treat each as a separate line of defense.
Where file permissions actually stop an agent
A permission setting is only as strong as the layer that enforces it. A file that is marked read-only in a config file, but not enforced by the operating system or the tool’s sandbox, does not stop anything.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Scope decides protection
Anthropic’s engineering article on sandboxing for Claude Code, “Making Claude Code more secure and autonomous with sandboxing,” says the sandbox is built on operating system-level features and enforces two boundaries: filesystem isolation and network isolation. It also says the boundary covers scripts, programs, and subprocesses spawned by commands. That is a description of one product. It is not a guarantee that every agent tool or every execution path works the same way.
Modes define how much a sandbox removes
NERSC’s technical documentation for OpenAI’s Codex, “Codex on Perlmutter,” separates three modes:
- read-only: inspection without filesystem changes.
- workspace-write: routine work inside the active workspace roots and temporary directories, with network access off unless enabled.
- danger-full-access: removes local sandbox restrictions.
In the workspace-write default described in that documentation, the .git, .agents, and .codex directories inside writable roots stay read-only. Treat these as the behavior documented for Codex in that source, and confirm the current defaults for your installed version before relying on them.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What a boundary does not stop
A boundary limits where the agent can act, not what it does inside that area. An agent that is allowed to write to a project folder can still overwrite or delete the files in it. Credentials stored inside the writable area are reachable by anything running there. If network access is enabled, the agent can send whatever it has read to a permitted destination. A sandbox narrows the blast radius; it does not judge intent.
What approval prompts add, and what they do not
An approval policy controls when the agent stops and asks. NERSC’s documentation describes Codex’s on-request approval setting as allowing actions inside the sandbox and asking for approval only when an action needs to cross a boundary. Its guidance is to inspect the proposed command and its target before approving an escalation.
OpenAI’s account of running Codex internally, “Running Codex safely at OpenAI,” describes enterprise controls that include managed requirements and command rules. Common benign commands can be allowed while specific dangerous commands are blocked or routed for approval. The same account describes telemetry covering user prompts, approval decisions, tool results, MCP use, and network decisions.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Two points follow. First, an approval gate is only as useful as the reviewer’s attention: approving a request without reading the command and target gives the agent the same reach as having no prompt at all. Second, telemetry is valuable for review and investigation. It records what happened, but it does not undo anything.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhat undo can and cannot restore
Undo features are scoped to what they track. Two examples show how different the scopes can be.
Visual Studio Code checkpoints
Microsoft’s documentation for reviewing and reverting agent changes in Visual Studio Code says checkpoints can restore affected workspace files and chat history to an earlier point. It states plainly that restoring a checkpoint does not reverse completed terminal commands, network requests, deployments, or changes to external services. Microsoft also describes checkpoints as temporary and recommends Git for permanent version history and collaboration.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Claude Code rewind
Anthropic’s Claude Code user FAQ in its Help Center says /rewind rolls back to an earlier checkpoint, and that checkpoints are taken automatically at each prompt. For changes that have already been committed, the FAQ points to Git revert. Do not assume this behaves identically to Visual Studio Code checkpoints. Each product defines its own tracked scope, and you should check the documentation for the version you run.
Illustrative example
Suppose an agent edits three source files, runs a migration script that drops a database table, and then triggers a deployment. A rewind restores the three files. The dropped table stays dropped, and the deployment stays live. Recovering those requires the database’s own backup or point-in-time restore and the deployment platform’s rollback. The file restore did what it was built to do; the rest of the damage sat outside its scope.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why the CLI and the editor are not the same boundary
Checkpoints usually cover what the editor or tool records, and terminal commands are where that record gets thin. A script that writes outside the tracked workspace, or a command that alters a file the tool did not log, may not appear in a restore point at all. Where the product documentation does not explicitly state that a command-line effect is captured, assume it is not.
A setup that matches what each control can actually do
- Narrow the writable area. Point the agent at a dedicated project directory or a separate working copy, not your home directory or a shared drive. For Codex, prefer
workspace-writeoverdanger-full-access. - Keep configuration and version-control directories read-only where the tool supports it, and confirm that
.gitis protected in your installed version. - Leave network access off by default. Enable it for a specific task and disable it afterward.
- Read each approval request. Check the exact command and target path before approving. Reject anything that reaches outside the project.
- Commit a clean baseline before a long run so Git holds a known-good state to return to.
- Review the diff before accepting changes. Use
git diffor your editor’s review view to see what changed, including files you did not expect. - Use service-specific recovery for external effects. Keep database backups, deployment rollback procedures, and provider-side recovery steps ready before the agent runs anything that touches them.
- Keep logs. Retain prompts, approvals, and command output so you can reconstruct what happened.
Troubleshooting: when recovery does not match expectations
- Files were restored, but a side effect remains. This is expected for terminal commands, network requests, deployments, and external service changes. Check the command history and use the affected service’s own recovery tools.
- The agent wrote outside the project. Check the active sandbox mode. Under a mode that removes local sandbox restrictions, the boundary is not in force. Confirm the mode and the writable roots in your configuration.
- A Git revert conflicts with later commits. Resolve the conflict with normal Git tools, or revert the later commits first. Recovery is still possible, but it is manual.
- Restored state looks incomplete. Confirm which checkpoint you selected and whether the product tracked the file in question. Files changed through commands outside the tracked workspace may not be included.
The vendor-reported figure, and how to read it
Anthropic reports an 84% reduction in permission prompts in its own internal usage, in the Claude Code sandboxing article cited above. The publication date was not shown in the version reviewed. This is a vendor’s internal result about user experience, not an independent measurement of security effectiveness, and it is not a benchmark across coding agents.
Current product documentation can change the behavior described here. Verify the product, version, operating system, and configuration before treating any default as settled.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
