An AI coding agent on a developer laptop should start with read access to the project, write access limited to the working branch, command execution behind an allow list, no production credentials, and restricted network access. Widen permissions only when a specific task needs it, and narrow them again afterwards.
Why start small
OWASP lists excessive permissions as a root cause of agent harm: extensions with more access to downstream systems than the task requires. It also recommends granting the minimum permissions and running actions under the individual user's identity and scope. A laptop is a rich target because it holds many credentials at once, so the starting point should be conservative.
A matrix you can adapt
| Capability | Laptop default | Sandbox or devcontainer | CI runner |
|---|---|---|---|
| Read project files | Allowed | Allowed | Allowed |
| Read files outside the project | Denied | Denied | Denied |
| Write files | Project only, working branch | Project only | Project only |
| Run shell commands | Allow list, ask for others | Broader allow list | Fixed steps only |
| Network access | Package registry and git host | Allow list | Allow list, no inbound |
| Cloud credentials | None | Short lived, scoped | Short lived, scoped |
| Push to default branch | Denied | Denied | Denied |
| Install packages | Ask each time | Ask, then review diff | Lockfile only |
The column matters as much as the row. The same action can be fine in a disposable container and risky on a laptop that holds a password manager session.
Steps to apply it
- Inventory the agent's current reach. Check which folders, shells, and network destinations it can use today. Most teams find broader access than they intended.
- Pick a default column for each user group. Junior contributors and contractors usually start in the sandbox column.
- Move secrets out of the project tree so a project read does not become a credential read.
- Write the exceptions down. If a task needs a broader permission, record who approved it and when it expires.
- Review monthly. Permissions drift upward because it is easier to say yes than to take access back.
Common mistakes
Granting a general shell because it is convenient. OWASP advises avoiding open-ended extensions such as a shell or URL fetch in favour of granular ones where you can. If you must allow a shell, pair it with the command allow list above.
Treating the approval prompt as the control. Prompts help, but people click through them. Enforce the limit in the environment so a rushed yes cannot exceed it. See does an approval prompt keep a coding agent in the project for the details.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a tool server is connected and what the agent is allowed to call, which is the permission surface this matrix describes.
Safeguard provides an MCP Guardrail and agent identity so you can scope what an agent calls and attribute its actions. Pull request gates cover the merge side.
Quick check
Should agents ever get write access to the default branch?
No. Let the agent open a pull request and let branch protection and a human reviewer decide.
Is a read only agent still risky?
Yes, if it can read secrets and has any outbound path. Read access plus network access can still leak data.
Sources
Last reviewed: 19 October 2026.
