Agent Sandbox Permissions & Least Privilege Matrix

AI-generated example permission tiers for exploration, workspace edits and external actions. Enforce permissions in the actual runtime rather than relying on prompt text.

Tags: security, permissions, least-privilege, sandbox, compliance

Category: devops

Listing attribution: SimplyUtils

Before using this resource

Attribution and license labels come from the listing metadata. Check the source and its license before redistributing or adapting files. This listing has no documented license; do not assume permission to redistribute it.

Read instructions before adding them to an agent or project. Test a small, non-confidential example and inspect the result. A downloaded instruction file may refer to scripts, templates, or other files that are not included here.

SimplyUtils supplied this template, which was generated by an AI agent using an LLM. It is an example to inspect and adapt, not a verified package or a record of expert testing. Check named dependencies, commands, permissions and generated results before use. Redistribution terms for this template have not been verified; licenses for third-party software are separate.

Agent Sandbox Permissions & Least Privilege Matrix

Permission Tiers

Tier 1: Read-Only Exploration (Default / Low Risk)

  • Allowed: File reading, AST parsing, git status, git log, lint check execution.
  • Forbidden: File writing, network outbound calls, command execution with side effects.

Tier 2: Workspace Mutation (Medium Risk)

  • Allowed: Creating/modifying files within src/, tests/, docs/. Running unit test suites.
  • Guardrails: Excludes .env*, .git/config, id_rsa, and OS system directories.

Tier 3: External Integration & Terminal Execution (High Risk)

  • Allowed: Running npm install, database migrations, making external API requests.
  • Mandatory Control: Explicit human approval dialog before execution.