Get featured

AI agent permissions for beginners: approval modes, allow/deny rules and sandboxes

Guide · checked against the docs on

Your agent will ask before it does some things and not others. Those prompts are your main safety net, and the "allow everything" options are where real damage can happen.

This guide explains three controls: approval modes (when the agent asks you), allow/deny rules (what it may do without asking) and sandboxes (what it can reach at all). It's quoted from Anthropic, OpenAI, Cursor and VS Code docs, checked Oct 2026. Mode names change often, so each one below is marked "checked Oct 2026".

Not affiliated with or endorsed by Anthropic, OpenAI, Anysphere, GitHub or Microsoft. Check their current docs before relying on these details.

Step 1: Know what each tool asks about by default

Each tool starts out asking for some actions and not others.

Watch one Cursor detail: "Agents can modify workspace files without approval, except for configuration files. Changes save immediately to disk. Always use version control so you can revert changes." (source) If you don't use git yet, start with git basics for AI coders.

Step 2: Use a read-only mode to explore

When you only want the agent to look around or plan, pick a mode that can't change your code.

Step 3: Loosen approvals one step at a time

Once you trust a task, you can let routine work run without a prompt for each step.

Older tutorials may tell you to set Codex's approval policy to "untrusted". Don't follow them: "Codex and ChatGPT Work no longer support approval_policy = 'untrusted'." (source)

Step 4: Avoid the "allow everything" modes on your own machine

Every tool has a mode that skips the prompts. The docs warn about each one.

You can also lock these modes off. In Claude Code, "To prevent bypassPermissions or auto mode from being used, set permissions.disableBypassPermissionsMode or permissions.disableAutoMode to 'disable' in any settings file." (source)

Step 5: Write allow and deny rules

Claude Code lets you list what's allowed, what needs a prompt, and what's blocked. The order matters: "Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order." So "An allow rule can't carve an exception out of a deny rule." (source)

Know the limit, too: "a deny or ask rule covers the invocation Claude usually produces and isn't a security boundary around the program." (source) Rules help, but a sandbox (Step 6) is the stronger wall.

Protect secret files with rules as well:

For more on this, see how to keep secrets safe with AI coding tools.

Step 6: Turn on a sandbox, and know what it covers

A sandbox limits what commands can touch, even if you approve them.

Step 7: Approve MCP tools and new projects with care

Cursor says: "All MCP connections need your approval. After you approve an MCP connection, each tool call still needs individual approval before running." (source)

For code you just downloaded, VS Code says: "Open untrusted projects in restricted mode. Until you've reviewed a project for malicious content, rely on the Workspace Trust boundary. Restricted mode disables agents in that workspace." (source)

An example setup

Here's a Claude Code settings file that turns off bypassPermissions mode, using the setting named in Step 4 (we haven't tried it ourselves). Check the permissions docs for the exact format before using it.

{
  "permissions": {
    "disableBypassPermissionsMode": "disable"
  }
}

Next steps

Sources

All checked Oct 15, 2026:

Not affiliated with or endorsed by Anthropic, OpenAI, Anysphere, GitHub or Microsoft. Check their current docs before relying on these details.