---
title: "Safety and permissions · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions
updated: 2026-10-20
licence: "All rights reserved"
---

# Safety and permissions

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Run agents in a sandbox with the fewest rights they need, keep production out of reach, and treat everything they read as possibly hostile.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers ai development playbook: https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions`.

## Required

- [Run agents in a sandbox](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/sandbox): Run coding agents in an isolated environment, such as a container, a virtual machine or the agent's own sandbox mode.
- [Skip approvals only in a throwaway sandbox](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/unattended-only-in-sandbox): Skip approvals only inside a container or virtual machine that holds no secrets. Throw it away after the task.
- [Keep production credentials away from agents](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/no-production-credentials): Never give a coding agent production keys, database passwords or customer data.
- [Give agents the fewest rights they need](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/least-privilege-agents): Give each agent token only the rights its task needs, and make it short-lived and easy to revoke.
- [Approve destructive commands](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/approve-destructive-commands): Require a person's approval before an agent deletes data, rewrites history, changes infrastructure or spends money.
- [Treat what the agent reads as untrusted](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/untrusted-context): Assume any web page, issue, file, dependency or tool result an agent reads may contain instructions meant to hijack it.
- [Run agents in CI only for trusted people](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/ci-agents-trusted-triggers): An agent in CI starts only for people with write access to the repository. Its job holds no secrets it does not need.
- [Review agent settings like code](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/review-agent-config): Treat instruction files, agent settings, hooks and rule folders as code that can run. Review every change to them and scan them for hidden text.
- [Open unknown repositories in a sandbox](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/untrusted-repositories): Open a repository you did not write in a container or virtual machine first. Trust it in your editor or agent only after reading its config.

## Recommended

- [Know what the agent tool does with your code](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/tool-data-terms): Before an agent reads your code, check whether its provider stores it, for how long, and whether it trains models on it.

- Previous: [Reviewing agent output](https://agentwranglers.se/playbook/ai-assisted-development/reviewing-agent-output)
- Next: [Apps built with AI builders](https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders)
- [All chapters](https://agentwranglers.se/playbook/ai-assisted-development)