Clank Safely

by Ignore Previous

Security setup and safety guidance for AI coding agents. An AI coding agent is a program that reads and changes files and runs commands on your computer for you. Claude Code and Codex are two of them. This page helps you set one up so it can't do more than you meant. Nothing on it changes your settings. You make the changes yourself.

What this page is, and is not

It is advice with sources. It does not block anything, and nothing here is enforced by us.

Where a setting is enforced, Claude Code or Codex enforces it, and we say which. This page is for someone who has already installed Claude Code or Codex and approved a few prompts. It is written for Claude Code on Windows first. The Codex settings are covered too.

The page is independent. OpenAI and Anthropic did not write or review it.

How to read the labels

Enforced Claude Code or Codex applies this itself, whatever the agent decides.
Guidance A written instruction the agent reads. It may ignore it.
Unverified We could not confirm this from the official pages we had. Check the page itself.
Pages disagree Official pages give different answers, so check your screen.
Our suggestion Our advice, not Anthropic's or OpenAI's.

Each Source link opens an official page, or the What's Allowed project. See "How we checked" at the end for what that means.

Step 1: check what your chat app can see

Guidance Advice: you change these settings yourself.

If you also use ChatGPT or Claude in a browser or an app, what it remembers and whether your chats are used for training are account settings. They are stored with your account on the provider's side, not on your computer, so the checker in Step 2 does not read them Source.

Our guide walks through them by hand, one step at a time: What Can My AI See?

Step 2: check what's allowed now

Check: reads your config files (the files that hold your tools' settings), sends nothing.

What's Allowed is our free checker. It reads the settings files of Claude Code, Codex and Cursor and flags risky ones. Each finding gives the file, the line and a rule code, with a reason and a fix Source.

Open a terminal in your project folder. A terminal is a window where you type commands. On Windows, use PowerShell. Run this. It needs Node.js 20 or later, the program that runs the tool Source.

npx whatsallowed

It reads your config and never changes it. It makes no network calls, and a test checks that on every build Source.
It does not change your settings. Its one file write is a baseline file in your home folder, and only when you run its baseline command Source.
It has no check for Claude Code's sandbox settings yet. The sandbox is explained in Step 3. Its list of checks has none for it Source.
A clean result does not mean your setup is safe. It is a configuration check, not a security assessment Source. How accurate its checks are is published.

Its findings are a report. They block nothing.

Step 3: turn on the protections your agent already has

Enforced Enforced by Claude Code or Codex, not by us.

Both tools have protections built in. This step names the settings in the words the official docs use. Below are three ways of working. Each name is a heading we use to explain a trade-off. A way of working is not a setting, and we do not offer a one-click switch. You change the settings yourself, in the files or menus the docs describe.

In Claude Code, settings live in JSON files (plain text files that list names and their values). Your own file is ~/.claude/settings.json and a project's is .claude/settings.json. A managed file, set by an administrator, wins over both Source. In Codex, your own file is ~/.codex/config.toml. A project's .codex/config.toml is read only for projects you have marked as trusted Source.

A few terms first. A permission mode is how often Claude Code asks you before acting. A rule allows or blocks one kind of action. A sandbox is a fence the operating system puts around the agent's commands, so they can touch only some files and some network addresses. An approval policy is Codex's name for how often it asks.

Cautious

Suits: you are new to agents, or the files matter (client work, or anything with passwords or keys), or you want to see each step.

Trade-off: you get asked more often, but not before every action. Claude Code's default mode "prompts for permission on first use of each tool" Source. Its plan mode reads files and runs read-only shell commands, and doesn't edit your source files Source. Codex in read-only mode can run some commands without asking: its approvals page says "Codex can read files and run commands within the read-only sandbox" Source. Pages disagree Its sandboxing page says this mode can't run commands without approval Source, so test it before you rely on it. The Codex settings below have both quotes. Many prompts can tempt you to approve without reading. Our suggestion Read each one.

Claude Code

permissions.defaultMode set to default. Claude Code "prompts for permission on first use of each tool." Enforced Source
permissions.defaultMode set to plan, for a first look at a project. Claude "reads files and runs read-only shell commands to explore but doesn't edit your source files." Enforced Source
permissions.deny rules. A deny rule blocks one kind of action. For example, a Read rule for ./.env stops Claude's file tools, and the file commands Claude Code recognises (such as cat), from reading a file of secrets. The docs say it does not cover every command that could read the file. For that, they point to the sandbox (see Balanced). Read rules use gitignore-style paths, the same pattern style Git uses in a .gitignore file to name files and folders. An allow rule "can't carve an exception out of a deny rule." Enforced Source
permissions.disableBypassPermissionsMode set to "disable", so the mode that skips prompts cannot be turned on. permissions.disableAutoMode does the same for auto mode. Enforced Source

Codex

sandbox_mode has three values: read-only, workspace-write and danger-full-access. Enforced Source
For this way of working, set sandbox_mode = "read-only". Our suggestion The docs say that in this mode "The agent can inspect files, but it can't edit files or run commands without approval." Enforced Source The approvals page describes it a little differently: "Codex can read files and run commands within the read-only sandbox." Which commands run without asking in this mode: Pages disagree Unverified The two pages do not agree. Test it before you rely on it Source.
approval_policy = "on-request". Commands the sandbox permits run without prompting, and the docs say "Codex asks for approval to edit files outside the workspace or to run commands that require network access." Enforced Source

Balanced

Suits: everyday work on your own project, where you review the result before you rely on it.

Trade-off: fewer prompts, because edits inside the project are approved for you and, where the sandbox runs, it fences the commands. An allow rule that is too wide removes the protection it was meant to give, so keep allow rules narrow.

Claude Code

permissions.defaultMode set to acceptEdits. It "automatically accepts file edits and common filesystem commands such as mkdir, touch, mv, and cp for paths in the working directory or additionalDirectories." Keep additionalDirectories short. Enforced Source
permissions.allow rules, one for each command you trust. A rule of Bash or Bash(*) on its own matches every command, and rules that limit a command's arguments are fragile. Rules are checked in the order deny, then ask, then allow. Enforced Source
permissions.deny rules for secrets files, as under Cautious. Enforced Source
The sandbox. The docs say sandboxing "provides OS-level enforcement that restricts shell commands' filesystem and network access." With the sandbox on and autoAllowBashIfSandboxed at its default of true, "the sandbox boundary substitutes for that whole-tool prompt." Enforced Source
The sandbox is off by default. Turn it on with the /sandbox command in a session, or set sandbox.enabled to true in ~/.claude/settings.json. To add folders it may write to, use sandbox.filesystem.allowWrite. To block paths, use sandbox.filesystem.denyWrite and sandbox.filesystem.denyRead. For sites, use sandbox.network.allowedDomains and sandbox.network.deniedDomains. Enforced Source Source
The sandbox does not run on native Windows. The docs say "On native Windows, Claude Code runs commands unsandboxed." It runs on macOS, Linux and WSL2 (Windows Subsystem for Linux 2), so on a Windows computer you would run Claude Code inside WSL2 to use it. Without it, nothing fences the commands, so keep your rules narrow. Guidance Source

Codex

sandbox_mode = "workspace-write" with approval_policy = "on-request". Our suggestion as the pairing. Each setting is Enforced Source
The docs say Codex "uses an OS-enforced sandbox that limits what it can touch (typically to the current workspace)." On macOS it uses Seatbelt, and on Linux bwrap plus seccomp. Enforced Source
On Windows, Codex has its own sandbox. The windows.sandbox setting picks one of three: mxc, which the docs recommend on compatible devices, or elevated and unelevated, which are fallbacks. The unelevated one has weaker network isolation. Inside WSL2, Codex uses the Linux sandbox. Enforced Source
"By default, the agent runs with network access turned off." Enforced Source
The folders .git, .agents, .codex and .aws inside a writable folder are protected as read-only. Enforced Source

Isolated Autonomy

Suits: a long job you leave running while you do something else. Our suggestion Do this only in an isolated place: a separate computer, or a virtual machine (a pretend computer running inside yours), holding a copy of the project and none of your real passwords or personal files.

Trade-off: the agent can do a lot without asking, so the fence around it does the protecting, not the prompts. If the fence is weak, a mistake or a prompt injection can do real harm. A prompt injection is hidden text in a web page or file that tells the agent to do something you did not ask for.

Claude Code

permissions.defaultMode set to auto. It "runs without routine prompts; before actions such as shell commands and network requests run, a background classifier checks that they align with your request." A classifier is a program that labels each action as fine or not fine. Enforced Source Unverified Whether auto mode is available on your plan or model was not checked, so it may not be on for you.
permissions.defaultMode set to dontAsk. It "auto-denies every call that would otherwise prompt." Actions that need no approval still run, such as file reads in your working directories, and so do tools you pre-approved with permissions.allow rules. There are two more exceptions. A mod you installed (an add-on for Claude Code) can still approve some calls this mode would deny. And a few tools are denied even if you allowed them, such as tools that need you to answer a question. So this mode does not promise that only the actions you listed can happen. Our suggestion Pair it with a short permissions.allow list, and expect the reads and other no-approval actions to keep working. Enforced Source
bypassPermissions skips permission prompts "except for the actions no mode auto-approves". The docs warn that it skips them even for "writes to protected paths such as .git and .claude". Those folders hold your project's history and Claude Code's own settings. Use it only inside the isolated place described above. Enforced Source
auto and bypassPermissions do not take effect when set in a project's or local settings file, only in your own or a managed one. Enforced Source
Keep the sandbox (on Windows, that means WSL2) and your deny rules on. The docs say sandbox restrictions "still apply even if a prompt injection bypasses Claude's decision-making." Enforced Source

Codex

approval_policy = "never" means "The agent doesn't stop for approval prompts." It works with every sandbox mode, and Codex makes "a best effort within the constraints you set". Our suggestion Pair it with sandbox_mode = "workspace-write", so the sandbox still fences the work. Enforced Source Source
Avoid sandbox_mode = "danger-full-access". The docs say that in this mode "The agent runs without sandbox restrictions", which removes the filesystem and network boundaries. Enforced Source
Network access is off by default. To turn it on, set network_access = true under [sandbox_workspace_write]. To limit it to chosen sites, use the network proxy, a go-between program that decides which sites a command can reach. Also set enabled = true under [features.network_proxy] and list the sites in domains, each marked "allow" or "deny". The docs say deny "always wins over allow". That proxy covers commands only. The docs say it does not filter web search, app tool calls or MCP (Model Context Protocol, a standard way to link an AI tool to other programs) server connections. Enforced Source

If an administrator manages your computer

An administrator can set rules that you and your projects cannot override. In Claude Code these are managed settings. The docs say "no other level, including command line arguments, can override a managed permission rule." The setting allowManagedPermissionRulesOnly "makes managed settings the only settings source of permission rules." Enforced Source

Do not try to change those files yourself. Ask your administrator.

What is enforced, and what is only advice

Who applies each control
Control	Status	Who applies it
Claude Code permission modes, allow rules and deny rules	Enforced	Claude Code. "Permission rules are enforced by Claude Code, not by the model." Source
The sandbox (Claude Code's sandbox, and Codex's sandbox_mode)	Enforced	The operating system, set up by the tool. For Codex, the docs say "OS-level mechanisms enforce sandbox policies" Source. For Claude Code, sandboxing "provides OS-level enforcement that restricts shell commands' filesystem and network access" Source, but it does not run on native Windows Source.
Trust for a project's own settings files	Enforced	Claude Code and Codex. Codex reads a project's config only for projects you marked as trusted Source. Claude Code applies a project's allow rules only after you accept the workspace trust dialog for that folder Source.
Managed settings	Enforced	The tool, with rules set by an administrator Source.
Codex asking before a destructive tool call	Enforced	Codex. "Destructive app/MCP tool calls always require approval when the tool advertises a destructive annotation", unless the tool also advertises a read annotation, which takes priority. An annotation is a label a tool attaches to itself to say what kind of action it is. Source
Account training and memory settings	Account setting	The provider's website. You change them yourself: see What Can My AI See?
"Ask before deleting" written in a file such as CLAUDE.md	Guidance	Nobody. The docs say instructions in your prompt or `CLAUDE.md` "shape what Claude tries to do, but they don't change what Claude Code allows." Source Codex's AGENTS.md is the same kind of file. The Codex docs say Codex reads it into the combined prompt it builds Source. They also say its security controls come from "two layers", the sandbox mode and the approval policy Source. AGENTS.md is neither. That is our reading of the docs, not a quote from them.
What's Allowed findings	Guidance	Nobody. They are a report, not a protection.
This page	Guidance	Nobody. It is advice, and you make the changes.

What this does not tell you

This shows what your setup allows. It doesn't prove your setup is safe.

No setting makes an agent safe on its own. The aim is smaller: to leave it able to do less than it could, and to know what it can do.

How we checked

Each Source link opens an official page: Anthropic's Claude Code permissions, settings, settings reference and sandboxing pages, and OpenAI's Codex approvals and security, config reference, sandboxing, Windows sandbox and AGENTS.md pages. Links about What's Allowed go to its project on GitHub.

On 24 Oct 2026 we compared each quote word for word with the text of the page itself, fetched directly and not through a summary. Anything that did not match was corrected or put in our own words. OpenAI's older Codex address, developers.openai.com/codex, now redirects to learn.chatgpt.com/docs, and that is the address we link. Docs change. If a setting name looks different on the page, trust the page.

Anything marked Unverified is a name or a claim we could not confirm from those pages. Check it there before you rely on it.

Back to the home page