Permissions, Sandboxes, and the Trust Question

The trust dial

The single design choice every AI CLI makes is the same: where does the dial sit between "ask before everything" and "do whatever you decide"? Claude Code calls it permission rules (allow / ask / deny). Codex calls it approval modes (untrusted / on-request / never) plus sandbox (read-only / workspace-write / danger-full-access). Gemini calls it sandbox + tool exclusions. Different vocabulary, identical mental model.

Every dial position trades off the same two costs. Too far toward "ask" and you become the bottleneck — every npm install stops the world. Too far toward "auto" and you're trusting a probabilistic system with rm -rf on your laptop. The honest answer is different settings for different jobs: tight gates on someone else's repo you just cloned, looser gates inside a Docker sandbox, "never ask" inside a CI runner that's already isolated.

The lesson that takes new users the longest to absorb: you don't pick one position once. Each tool's design assumes you'll move the dial mid-session as confidence grows or shrinks, and the slash commands (/permissions, /approvals) exist for exactly that.

Code

Same idea, three syntaxes·bash

# Claude Code — rule-based, deny → ask → allow
# .claude/settings.json
{
  "permissions": {
    "allow": ["Bash(npm test)", "Bash(git diff *)", "Read"],
    "ask":   ["Bash(git push *)"],
    "deny":  ["Bash(rm -rf *)", "Read(./.env)"]
  }
}

# Codex CLI — approval mode + sandbox mode
codex --ask-for-approval on-request --sandbox workspace-write

# Gemini CLI — sandbox container + tool exclusion
gemini --sandbox -e "WriteFile,RunShellCommand"

Tight to loose, same task·bash

# 1. Brand-new repo, you don't trust the code yet
codex --sandbox read-only "explain what this project does"

# 2. Familiar repo, normal coding
codex                                    # default: workspace-write + on-request

# 3. Inside a Docker container, fully isolated
codex --sandbox danger-full-access --ask-for-approval never \
      "fix all eslint errors and rebuild"

# Same CLI, three trust levels — one per situation

Exercise

On your everyday machine, configure your most-used CLI with at least three allow rules (the commands you re-approve every session) and at least two deny rules (the commands you never want it running). Run a session and notice how many fewer prompts you hit. Capture the diff in your notes — that delta is your real productivity gain.

Permissions, Sandboxes, and the Trust Question

The trust dial

Code

External links

Exercise

Progress

Comments 0