# Clank Safely > A plain page for setting up Claude Code or Codex so it cannot do more than you meant. Check what is allowed now, then pick a way of working, with the official setting names. > > Markdown copy of https://ignoreprevious.dev/clank-safely/ by Ignore Previous Security setup and safety guidance for AI coding agents. An AI coding agent is a program that reads and changes files and runs commands on your computer for you. Claude Code and Codex are two of them. This page helps you set one up so it can't do more than you meant. Nothing on it changes your settings. You make the changes yourself. ## What this page is, and is not It is advice with sources. It does not block anything, and nothing here is enforced by us. Where a setting is enforced, Claude Code or Codex enforces it, and we say which. This page is for someone who has already installed Claude Code or Codex and approved a few prompts. It is written for Claude Code on Windows first. The Codex settings are covered too. The page is independent. OpenAI and Anthropic did not write or review it. ### How to read the labels - [Enforced] Claude Code or Codex applies this itself, whatever the agent decides. - [Guidance] A written instruction the agent reads. It may ignore it. - [Unverified] We could not confirm this from the official pages we had. Check the page itself. - [Pages disagree] Official pages give different answers, so check your screen. - [Our suggestion] Our advice, not Anthropic's or OpenAI's. Each Source link opens an official page, or the What's Allowed project. See "How we checked" at the end for what that means. ## Step 1: check what your chat app can see [Guidance] **Advice: you change these settings yourself.** If you also use ChatGPT or Claude in a browser or an app, what it remembers and whether your chats are used for training are account settings. They are stored with your account on the provider's side, not on your computer, so the checker in Step 2 does not read them [Source: What's Allowed project page, list of checks](https://github.com/ignore-previous/whatsallowed#readme). Our guide walks through them by hand, one step at a time: [What Can My AI See?](https://ignoreprevious.dev/what-can-my-ai-see/) ## Step 2: check what's allowed now **Check: reads your config files (the files that hold your tools' settings), sends nothing.** What's Allowed is our free checker. It reads the settings files of Claude Code, Codex and Cursor and flags risky ones. Each finding gives the file, the line and a rule code, with a reason and a fix [Source: What's Allowed project page](https://github.com/ignore-previous/whatsallowed#readme). Open a terminal in your project folder. A terminal is a window where you type commands. On Windows, use PowerShell. Run this. It needs Node.js 20 or later, the program that runs the tool [Source: What's Allowed project page, first run](https://github.com/ignore-previous/whatsallowed#readme). ``` npx whatsallowed ``` - It reads your config and never changes it. It makes no network calls, and a test checks that on every build [Source: What's Allowed test that it makes no network calls](https://github.com/ignore-previous/whatsallowed/blob/main/test/no-network.test.ts). - It does not change your settings. Its one file write is a baseline file in your home folder, and only when you run its `baseline` command [Source: What's Allowed project page, commands](https://github.com/ignore-previous/whatsallowed#readme). - It has no check for Claude Code's sandbox settings yet. The sandbox is explained in Step 3. Its list of checks has none for it [Source: What's Allowed project page, list of checks](https://github.com/ignore-previous/whatsallowed#readme). - A clean result does not mean your setup is safe. It is a configuration check, not a security assessment [Source: What's Allowed project page](https://github.com/ignore-previous/whatsallowed#readme). [How accurate its checks are](https://github.com/ignore-previous/whatsallowed/blob/main/docs/ACCURACY.md) is published. Its findings are a report. They block nothing. ## Step 3: turn on the protections your agent already has [Enforced] **Enforced by Claude Code or Codex, not by us.** Both tools have protections built in. This step names the settings in the words the official docs use. Below are three ways of working. Each name is a heading we use to explain a trade-off. A way of working is not a setting, and we do not offer a one-click switch. You change the settings yourself, in the files or menus the docs describe. In Claude Code, settings live in JSON files (plain text files that list names and their values). Your own file is `~/.claude/settings.json` and a project's is `.claude/settings.json`. A managed file, set by an administrator, wins over both [Source: Claude Code settings, official docs](https://code.claude.com/docs/en/settings). In Codex, your own file is `~/.codex/config.toml`. A project's `.codex/config.toml` is read only for projects you have marked as trusted [Source: Codex config reference, official docs](https://learn.chatgpt.com/docs/config-file/config-reference). A few terms first. A **permission mode** is how often Claude Code asks you before acting. A **rule** allows or blocks one kind of action. A **sandbox** is a fence the operating system puts around the agent's commands, so they can touch only some files and some network addresses. An **approval policy** is Codex's name for how often it asks. ### Cautious **Suits:** you are new to agents, or the files matter (client work, or anything with passwords or keys), or you want to see each step. **Trade-off:** you get asked more often, but not before every action. Claude Code's default mode "prompts for permission on first use of each tool" [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions). Its plan mode reads files and runs read-only shell commands, and doesn't edit your source files [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions). Codex in read-only mode can run some commands without asking: its approvals page says "Codex can read files and run commands within the read-only sandbox" [Source: Codex approvals and security, official docs](https://learn.chatgpt.com/docs/agent-approvals-security). [Pages disagree] Its sandboxing page says this mode can't run commands without approval [Source: Codex sandboxing, official docs](https://learn.chatgpt.com/docs/sandboxing), so test it before you rely on it. The Codex settings below have both quotes. Many prompts can tempt you to approve without reading. [Our suggestion] Read each one. #### Claude Code - `permissions.defaultMode` set to `default`. Claude Code "prompts for permission on first use of each tool." [Enforced] [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions) - `permissions.defaultMode` set to `plan`, for a first look at a project. Claude "reads files and runs read-only shell commands to explore but doesn't edit your source files." [Enforced] [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions) - `permissions.deny` rules. A deny rule blocks one kind of action. For example, a `Read` rule for `./.env` stops Claude's file tools, and the file commands Claude Code recognises (such as `cat`), from reading a file of secrets. The docs say it does not cover every command that could read the file. For that, they point to the sandbox (see Balanced). Read rules use gitignore-style paths, the same pattern style Git uses in a `.gitignore` file to name files and folders. An allow rule "can't carve an exception out of a deny rule." [Enforced] [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions) - `permissions.disableBypassPermissionsMode` set to `"disable"`, so the mode that skips prompts cannot be turned on. `permissions.disableAutoMode` does the same for auto mode. [Enforced] [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions) #### Codex - `sandbox_mode` has three values: `read-only`, `workspace-write` and `danger-full-access`. [Enforced] [Source: Codex config reference, official docs](https://learn.chatgpt.com/docs/config-file/config-reference) - For this way of working, set `sandbox_mode = "read-only"`. [Our suggestion] The docs say that in this mode "The agent can inspect files, but it can't edit files or run commands without approval." [Enforced] [Source: Codex sandboxing, official docs](https://learn.chatgpt.com/docs/sandboxing) The approvals page describes it a little differently: "Codex can read files and run commands within the read-only sandbox." Which commands run without asking in this mode: [Pages disagree] [Unverified] The two pages do not agree. Test it before you rely on it [Source: Codex approvals and security, official docs](https://learn.chatgpt.com/docs/agent-approvals-security). - `approval_policy = "on-request"`. Commands the sandbox permits run without prompting, and the docs say "Codex asks for approval to edit files outside the workspace or to run commands that require network access." [Enforced] [Source: Codex approvals and security, official docs](https://learn.chatgpt.com/docs/agent-approvals-security) ### Balanced **Suits:** everyday work on your own project, where you review the result before you rely on it. **Trade-off:** fewer prompts, because edits inside the project are approved for you and, where the sandbox runs, it fences the commands. An allow rule that is too wide removes the protection it was meant to give, so keep allow rules narrow. #### Claude Code - `permissions.defaultMode` set to `acceptEdits`. It "automatically accepts file edits and common filesystem commands such as `mkdir`, `touch`, `mv`, and `cp` for paths in the working directory or `additionalDirectories`." Keep `additionalDirectories` short. [Enforced] [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions) - `permissions.allow` rules, one for each command you trust. A rule of `Bash` or `Bash(*)` on its own matches every command, and rules that limit a command's arguments are fragile. Rules are checked in the order deny, then ask, then allow. [Enforced] [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions) - `permissions.deny` rules for secrets files, as under Cautious. [Enforced] [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions) - The sandbox. The docs say sandboxing "provides OS-level enforcement that restricts shell commands' filesystem and network access." With the sandbox on and `autoAllowBashIfSandboxed` at its default of `true`, "the sandbox boundary substitutes for that whole-tool prompt." [Enforced] [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions) - The sandbox is off by default. Turn it on with the `/sandbox` command in a session, or set `sandbox.enabled` to `true` in `~/.claude/settings.json`. To add folders it may write to, use `sandbox.filesystem.allowWrite`. To block paths, use `sandbox.filesystem.denyWrite` and `sandbox.filesystem.denyRead`. For sites, use `sandbox.network.allowedDomains` and `sandbox.network.deniedDomains`. [Enforced] [Source: Claude Code sandboxing, official docs](https://code.claude.com/docs/en/sandboxing) [Source: Claude Code settings reference, official docs](https://code.claude.com/docs/en/settings-reference) - The sandbox does not run on native Windows. The docs say "On native Windows, Claude Code runs commands unsandboxed." It runs on macOS, Linux and WSL2 (Windows Subsystem for Linux 2), so on a Windows computer you would run Claude Code inside WSL2 to use it. Without it, nothing fences the commands, so keep your rules narrow. [Guidance] [Source: Claude Code sandboxing, official docs](https://code.claude.com/docs/en/sandboxing) #### Codex - `sandbox_mode = "workspace-write"` with `approval_policy = "on-request"`. [Our suggestion] as the pairing. Each setting is [Enforced] [Source: Codex approvals and security, official docs](https://learn.chatgpt.com/docs/agent-approvals-security) - The docs say Codex "uses an OS-enforced sandbox that limits what it can touch (typically to the current workspace)." On macOS it uses Seatbelt, and on Linux `bwrap` plus `seccomp`. [Enforced] [Source: Codex approvals and security, official docs](https://learn.chatgpt.com/docs/agent-approvals-security) - On Windows, Codex has its own sandbox. The `windows.sandbox` setting picks one of three: `mxc`, which the docs recommend on compatible devices, or `elevated` and `unelevated`, which are fallbacks. The `unelevated` one has weaker network isolation. Inside WSL2, Codex uses the Linux sandbox. [Enforced] [Source: Codex Windows sandbox, official docs](https://learn.chatgpt.com/docs/windows/windows-sandbox) - "By default, the agent runs with network access turned off." [Enforced] [Source: Codex approvals and security, official docs](https://learn.chatgpt.com/docs/agent-approvals-security) - The folders `.git`, `.agents`, `.codex` and `.aws` inside a writable folder are protected as read-only. [Enforced] [Source: Codex approvals and security, official docs](https://learn.chatgpt.com/docs/agent-approvals-security) ### Isolated Autonomy **Suits:** a long job you leave running while you do something else. [Our suggestion] Do this only in an isolated place: a separate computer, or a virtual machine (a pretend computer running inside yours), holding a copy of the project and none of your real passwords or personal files. **Trade-off:** the agent can do a lot without asking, so the fence around it does the protecting, not the prompts. If the fence is weak, a mistake or a prompt injection can do real harm. A prompt injection is hidden text in a web page or file that tells the agent to do something you did not ask for. #### Claude Code - `permissions.defaultMode` set to `auto`. It "runs without routine prompts; before actions such as shell commands and network requests run, a background classifier checks that they align with your request." A classifier is a program that labels each action as fine or not fine. [Enforced] [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions) [Unverified] Whether auto mode is available on your plan or model was not checked, so it may not be on for you. - `permissions.defaultMode` set to `dontAsk`. It "auto-denies every call that would otherwise prompt." Actions that need no approval still run, such as file reads in your working directories, and so do tools you pre-approved with `permissions.allow` rules. There are two more exceptions. A mod you installed (an add-on for Claude Code) can still approve some calls this mode would deny. And a few tools are denied even if you allowed them, such as tools that need you to answer a question. So this mode does not promise that only the actions you listed can happen. [Our suggestion] Pair it with a short `permissions.allow` list, and expect the reads and other no-approval actions to keep working. [Enforced] [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions) - `bypassPermissions` skips permission prompts "except for the actions no mode auto-approves". The docs warn that it skips them even for "writes to protected paths such as `.git` and `.claude`". Those folders hold your project's history and Claude Code's own settings. Use it only inside the isolated place described above. [Enforced] [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions) - `auto` and `bypassPermissions` do not take effect when set in a project's or local settings file, only in your own or a managed one. [Enforced] [Source: Claude Code settings, official docs](https://code.claude.com/docs/en/settings) - Keep the sandbox (on Windows, that means WSL2) and your deny rules on. The docs say sandbox restrictions "still apply even if a prompt injection bypasses Claude's decision-making." [Enforced] [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions) #### Codex - `approval_policy = "never"` means "The agent doesn't stop for approval prompts." It works with every sandbox mode, and Codex makes "a best effort within the constraints you set". [Our suggestion] Pair it with `sandbox_mode = "workspace-write"`, so the sandbox still fences the work. [Enforced] [Source: Codex sandboxing, official docs](https://learn.chatgpt.com/docs/sandboxing) [Source: Codex approvals and security, official docs](https://learn.chatgpt.com/docs/agent-approvals-security) - Avoid `sandbox_mode = "danger-full-access"`. The docs say that in this mode "The agent runs without sandbox restrictions", which removes the filesystem and network boundaries. [Enforced] [Source: Codex sandboxing, official docs](https://learn.chatgpt.com/docs/sandboxing) - Network access is off by default. To turn it on, set `network_access = true` under `[sandbox_workspace_write]`. To limit it to chosen sites, use the network proxy, a go-between program that decides which sites a command can reach. Also set `enabled = true` under `[features.network_proxy]` and list the sites in `domains`, each marked `"allow"` or `"deny"`. The docs say `deny` "always wins over `allow`". That proxy covers commands only. The docs say it does not filter web search, app tool calls or MCP (Model Context Protocol, a standard way to link an AI tool to other programs) server connections. [Enforced] [Source: Codex approvals and security, official docs](https://learn.chatgpt.com/docs/agent-approvals-security) ### If an administrator manages your computer An administrator can set rules that you and your projects cannot override. In Claude Code these are managed settings. The docs say "no other level, including command line arguments, can override a managed permission rule." The setting `allowManagedPermissionRulesOnly` "makes managed settings the only settings source of permission rules." [Enforced] [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions) Do not try to change those files yourself. Ask your administrator. ## What is enforced, and what is only advice _Who applies each control_ | Control | Status | Who applies it | | --- | --- | --- | | Claude Code permission modes, allow rules and deny rules | [Enforced] | Claude Code. "Permission rules are enforced by Claude Code, not by the model." [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions) | | The sandbox (Claude Code's sandbox, and Codex's `sandbox_mode`) | [Enforced] | The operating system, set up by the tool. For Codex, the docs say "OS-level mechanisms enforce sandbox policies" [Source: Codex approvals and security, official docs](https://learn.chatgpt.com/docs/agent-approvals-security). For Claude Code, sandboxing "provides OS-level enforcement that restricts shell commands' filesystem and network access" [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions), but it does not run on native Windows [Source: Claude Code sandboxing, official docs](https://code.claude.com/docs/en/sandboxing). | | Trust for a project's own settings files | [Enforced] | Claude Code and Codex. Codex reads a project's config only for projects you marked as trusted [Source: Codex config reference, official docs](https://learn.chatgpt.com/docs/config-file/config-reference). Claude Code applies a project's allow rules only after you accept the workspace trust dialog for that folder [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions). | | Managed settings | [Enforced] | The tool, with rules set by an administrator [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions). | | Codex asking before a destructive tool call | [Enforced] | Codex. "Destructive app/MCP tool calls always require approval when the tool advertises a destructive annotation", unless the tool also advertises a read annotation, which takes priority. An annotation is a label a tool attaches to itself to say what kind of action it is. [Source: Codex approvals and security, official docs](https://learn.chatgpt.com/docs/agent-approvals-security) | | Account training and memory settings | Account setting | The provider's website. You change them yourself: see [What Can My AI See?](https://ignoreprevious.dev/what-can-my-ai-see/) | | "Ask before deleting" written in a file such as `CLAUDE.md` | [Guidance] | Nobody. The docs say instructions in your prompt or `CLAUDE.md` "shape what Claude tries to do, but they don't change what Claude Code allows." [Source: Claude Code permissions, official docs](https://code.claude.com/docs/en/permissions) Codex's `AGENTS.md` is the same kind of file. The Codex docs say Codex reads it into the combined prompt it builds [Source: Codex AGENTS.md, official docs](https://learn.chatgpt.com/docs/agent-configuration/agents-md). They also say its security controls come from "two layers", the sandbox mode and the approval policy [Source: Codex approvals and security, official docs](https://learn.chatgpt.com/docs/agent-approvals-security). `AGENTS.md` is neither. That is our reading of the docs, not a quote from them. | | What's Allowed findings | [Guidance] | Nobody. They are a report, not a protection. | | This page | [Guidance] | Nobody. It is advice, and you make the changes. | ## What this does not tell you This shows what your setup allows. It doesn't prove your setup is safe. No setting makes an agent safe on its own. The aim is smaller: to leave it able to do less than it could, and to know what it can do. ## How we checked Each Source link opens an official page: Anthropic's [Claude Code permissions](https://code.claude.com/docs/en/permissions), [settings](https://code.claude.com/docs/en/settings), [settings reference](https://code.claude.com/docs/en/settings-reference) and [sandboxing](https://code.claude.com/docs/en/sandboxing) pages, and OpenAI's Codex [approvals and security](https://learn.chatgpt.com/docs/agent-approvals-security), [config reference](https://learn.chatgpt.com/docs/config-file/config-reference), [sandboxing](https://learn.chatgpt.com/docs/sandboxing), [Windows sandbox](https://learn.chatgpt.com/docs/windows/windows-sandbox) and [AGENTS.md](https://learn.chatgpt.com/docs/agent-configuration/agents-md) pages. Links about What's Allowed go to its project on GitHub. On 24 Oct 2026 we compared each quote word for word with the text of the page itself, fetched directly and not through a summary. Anything that did not match was corrected or put in our own words. OpenAI's older Codex address, `developers.openai.com/codex`, now redirects to `learn.chatgpt.com/docs`, and that is the address we link. Docs change. If a setting name looks different on the page, trust the page. Anything marked [Unverified] is a name or a claim we could not confirm from those pages. Check it there before you rely on it. --- [github.com/ignore-previous](https://github.com/ignore-previous) The code for this site, What's Allowed and Unclank is public there. Say hello: hello@ignoreprevious.dev New to ChatGPT or Claude? [Read What Can My AI See?](https://ignoreprevious.dev/what-can-my-ai-see/) No cookies, no personal data, no tracking across sites. Yes, the name is a joke. The tools are not. Fonts served from this site: Bricolage Grotesque (The Bricolage Grotesque Project Authors), Figtree (The Figtree Project Authors) and JetBrains Mono (The JetBrains Mono Project Authors). [SIL Open Font License 1.1](https://ignoreprevious.dev/assets/fonts/OFL.txt).