Security Sandbox & Permissions

~16 min · dispatch, security, sandbox, permissions

Level 0🌱 Novice

0 XP0/70 lessons0/11 achievements

0/120 XP to next level120 XP to go0% complete

Pre-authorization is not blanket trust

Dispatch has stricter defaults than Cowork because you're not present to react. The model: everything Dispatch is allowed to do has been pre-declared in writing. Anything outside the pre-declaration is denied automatically — Dispatch doesn't fall back to "ask the user" because the user is on a train.

Three layers: filesystem allowlist (specific paths, with read vs read+write per path), application allowlist (only listed apps can be opened/operated), tool denylist (operations like SendEmail, DeleteFiles, PostToSocialMedia are off by default and require explicit grant). Network access is constrained to MCP connectors you've already approved.

Audit: every Dispatch task writes to ~/Library/Logs/Claude/dispatch-audit.jsonl — task id, timestamp, tools used, files touched, MCP calls made. When you come home and find a pile of finished work, the audit log is your trust verification.

Code

A locked-down dispatch-policy.json·json

{
  "dispatch": {
    "allowedPaths": {
      "~/DispatchWork":          ["read", "write"],
      "~/Documents/Finance":     ["read"],
      "~/Desktop":               ["write"]
    },
    "allowedApps":   ["Safari", "Finder", "TextEdit", "Preview"],
    "deniedTools":   ["SendEmail", "DeleteFiles", "PostToSocialMedia"],
    "network": {
      "mcpOnly":   true,
      "allowlist": ["api.anthropic.com", "mcp.notion.com"]
    },
    "auditLog": {
      "enabled": true,
      "path":    "~/Library/Logs/Claude/dispatch-audit.jsonl"
    }
  }
}

An audit log entry·json

// ~/Library/Logs/Claude/dispatch-audit.jsonl (one line per event)
{
  "ts": "2026-05-04T08:23:11Z",
  "task_id": "dsp_x7k9m2",
  "user": "you@example.com",
  "intent": "summarize Q4 earnings, save to ~/Desktop",
  "tools_used": ["Read", "Write"],
  "files_read": ["/Documents/Finance/q4-earnings.pdf"],
  "files_written": ["/Desktop/exec-summary-q4.pdf"],
  "mcp_calls": [],
  "duration_ms": 24818,
  "status": "completed"
}

External links

Dispatch security model

Exercise

Lock down your Dispatch policy: list every path Dispatch can read, every path it can write, and every app it can drive. Push the deny list as long as honestly possible. Send a task that should fail (write to a forbidden path) — confirm it gets denied.