# Agent permissions & sandboxing URL: https://justuju.org/concept/agent-permissions/ Layer 8 · Agents Giving an AI agent only the tools, data and network access a task needs, running it in a sandbox, and asking a person before risky actions. ## Simple An AI agent acts for you: it runs code, edits files, sends messages. Whatever it can do, a tricked or broken agent can do too. So give it only what the job needs. An agent fixing a typo does not need your email or the power to delete servers. This is least privilege. Run it in a sandbox: a closed room with its own copy of the files and no open door to the internet unless the task needs one. For risky steps, such as deleting, paying or sending data out, have it stop and ask a person. Keep a log so you can see what it did. These limits work even when the agent is fooled, because they do not depend on the agent noticing the attack. 1. Task: what is it for? 2. Least tools: only what it needs 3. Sandbox: files and network fenced 4. Approval: a person for risky steps 5. Log: every action Like: A temp worker given one office key, a visitor badge and a rule to ask before spending money. Where it breaks: A temp works at human speed. An agent can try thousands of actions a minute, so limits must be enforced by the system, not trusted to its judgement. ## How it works Excessive agency is OWASP's name for the root problem: excessive functionality (tools a task doesn't need), excessive permissions (tools that can do more than needed) and excessive autonomy (high-impact actions without checks). Scoping maps each task to a minimal tool set and credential scopes: read-only tokens, single-repository access, short expiry. Credentials live outside the agent's environment where possible, so injected instructions cannot read them. Sandboxing runs the agent's code and tools in a container or virtual machine with a restricted filesystem and an egress allow-list. The sandbox boundary, not the model, decides what can leave. Human approval gates irreversible or outbound actions, showing the exact command or message. Audit logs record every tool call with its inputs, for detection and for investigation afterwards. - Tight scopes mean more prompts and setup; loose scopes are convenient until something goes wrong. - Approval fatigue is real: if every step needs a click, people stop reading. - Sandboxes can be escaped by kernel or container bugs; keep them patched and layered. ## Research Real cases. An overscoped build token let an attacker commit a destructive prompt into a released AI coding extension; the vendor says it was malformed and did not run (AWS-2025-015); prompt injection made a CI coding agent read its own environment and leak an API key (Microsoft, 2026). Design patterns. Plan-then-execute, action selectors and dual-model isolation give agents provable resistance to injected control flow at some cost in flexibility (Beurer-Kellner et al., 2025; CaMeL). Threat models. OWASP's Top 10 for Agentic Applications (December 2025) ranks the main risks of agents that plan, use tools and keep memory, building on its earlier agentic threat list, which covers privilege compromise, tool misuse and memory poisoning (OWASP, 2025; OWASP, Feb 2025). Open questions. How to infer the minimal permission set for open-ended tasks automatically, and how to design approvals people don't rubber-stamp. ## Examples as of 2026-11-10 - Claude Code sandboxed Bash tool: OS-level file and network isolation, with an empty network allow-list to start - OpenAI Codex sandbox and approval modes: network off by default in workspace-write mode - OWASP Top 10 for Agentic Applications (2026 edition, December 2025) - OWASP Top 10 for LLM Applications: LLM03:2026 Excessive Agency (LLM06 in 2025) - MITRE ATLAS mitigation AML.M0029 Human In-the-Loop for AI Agent Actions ## Sources - OWASP Top 10 for LLM Applications: LLM06:2025 Excessive Agency: https://genai.owasp.org/llmrisk/llm062025-excessive-agency/ - OWASP Agentic AI: Threats and Mitigations: https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/ - Security Update for Amazon Q Developer Extension for Visual Studio Code (AWS-2025-015): https://aws.amazon.com/security/security-bulletins/AWS-2025-015/ - Securing CI/CD in an agentic world: Claude Code GitHub action case (Microsoft Security Blog): https://www.microsoft.com/en-us/security/blog/2026/06/05/securing-ci-cd-in-agentic-world-claude-code-github-action-case/ - Design Patterns for Securing LLM Agents against Prompt Injections: https://arxiv.org/abs/2506.08837 - Defeating Prompt Injections by Design (CaMeL): https://arxiv.org/abs/2503.18813 - MITRE ATLAS data, release 2026.10 (the data behind atlas.mitre.org): https://github.com/mitre-atlas/atlas-data - OWASP Top 10 for Agentic Applications (2026 edition, published December 2025): https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/ - Configure the sandboxed Bash tool (Claude Code Docs, Anthropic): https://code.claude.com/docs/en/sandboxing - Making Claude Code safer with sandboxing (Anthropic Engineering): https://www.anthropic.com/engineering/claude-code-sandboxing - Codex: Sandbox (OpenAI Developers): https://developers.openai.com/codex/concepts/sandboxing - Codex: Agent approvals & security (OpenAI Developers): https://developers.openai.com/codex/agent-approvals-security - OWASP GenAI Security Project unveils the 2026 Top 10 for LLM Applications (OWASP): https://genai.owasp.org/2026/09/01/owasp-genai-security-project-unveils-2026-top-10-for-llm-applications-new-agent-control-standard-and-sponsors-as-community-tops-30000-members/ --- Justuju · https://justuju.org/ · Content CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Quote with a link to the page.