Permissions & Sandboxes Compared

~14 min · permissions, sandbox, cross-tool, safety

Level 0🌱 Novice

0 XP0/70 lessons0/11 achievements

0/120 XP to next level120 XP to go0% complete

Different vocabulary, same dial

Every CLI ships a permission/sandbox model. The terminology drifts; the dial is the same. Claude Code: rule-based allow/ask/deny per tool spec, evaluated deny-first. Codex: approval modes (untrusted/on-request/never) × sandbox modes (read-only/workspace-write/danger-full-access). Gemini: container sandbox (Docker) + tool exclusion list.

The shared mental model: at one extreme, ask before everything (sensitive code, untrusted repo); at the other extreme, do everything inside isolation (Docker container, sandbox VM, CI runner with no real credentials). The right position depends on the job, not the CLI.

Code

Three CLIs, three syntaxes, same idea·bash

# Tight: untrusted code, ask before anything
claude --permission-mode ask
codex --ask-for-approval untrusted --sandbox read-only
gemini --sandbox -e "Edit,Write,RunShellCommand"

# Default: trusted local work
claude                     # default: ask for risky, allow for safe
codex                      # on-request + workspace-write
gemini                     # no sandbox, normal tools

# Loose: inside Docker / sandbox VM
claude --dangerouslySkipPermissions
codex --yolo
gemini --sandbox            # container ITSELF is the safety

Pick by job, not by CLI·text

Job                                          Trust dial
First time on someone else's repo            Tight (any CLI)
Daily coding on familiar repo                Default
Background CI in Docker                      Loose (CLI doesn't matter much)
Migration touching auth/payments             Tight
"Just play with this idea"                  Default

# The CLI matters less than the dial position.

External links

Exercise

Pick a sensitive task (touch auth code in a real repo). Run it three times — once tight, once default, once loose — in your CLI of choice. Note where the friction was useful and where it was just friction.

Progress

Progress is local-only — sign in to sync across devices.

← PreviousCLAUDE.md / AGENTS.md / GEMINI.md — One Pattern, Three Names Next →Skills & Custom Commands as Cross-CLI Capability

Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)

No comments yet — be the first.