---
title: "Skip approvals only in a throwaway sandbox · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/unattended-only-in-sandbox
id: AID-24
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 847
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Skip approvals only in a throwaway sandbox

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AID-24
- Level: Required
- Chapter: [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)
- Rule: Skip approvals only inside a container or virtual machine that holds no secrets. Throw it away after the task.
- Check: A CI script searches the repository for the bypass flags. Each match sits on a line that starts a container, such as `docker run`. On a staff machine, starting the mode fails.
- Risk: An account or system taken over
- How: Unattended modes run every command without asking. Examples are `--dangerously-skip-permissions` in Claude Code and `--dangerously-bypass-approvals-and-sandbox` in Codex. Start them only from a script that creates the container first. Mount only the project folder, allow only the hosts the task needs. Cap the turns and the spend, as in [cost and loop limits](https://agentwranglers.se/playbook/ai-features/agents-in-products/agent-run-limits.md). Turn the mode off on staff machines through managed settings, where the tool offers them.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```bash
grep -rnE 'dangerously-(skip-permissions|bypass-approvals)|bypassPermissions|--yolo' --include='*.sh' --include='*.yml' . \
  | grep -v 'docker run' && exit 1 || exit 0
```

## Sources

- [Claude Code, development containers](https://code.claude.com/docs/en/devcontainer)

## Related rules

- AIF-71 [Stop every agent run at fixed limits set in code](https://agentwranglers.se/playbook/ai-features/agents-in-products/agent-run-limits.md) in AI features
- AID-62 [Cap what your coding agents can spend](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/agent-spend-limits.md) in AI-assisted development
- AID-33 [Enforce the team's agent settings centrally](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/managed-agent-settings.md) in AI-assisted development

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/unattended-only-in-sandbox">Agent Wranglers AI-assisted development playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Allow agent network traffic only to listed hosts](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/egress-allow-list.md)
- Next: [Keep production credentials away from agents](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/no-production-credentials.md)
- [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)