Your Coding Agent Should Not Have Your Permissions

If your AI coding agent runs with the same permissions you do, you're one hallucination away from a bad day.

Coding agents like Claude Code, Gemini CLI, or Codex are incredibly capable. They write code, install packages, modify files, and execute commands — often autonomously. That's exciting, and it's also a moment to slow down just a bit. The real question isn't whether these agents are useful. It's what reasonable boundaries look like when software can act on your behalf.

All it takes is one ambiguous instruction and an agent cleaning up "unused files" outside the directory you had in mind. I don't think AI coding agents should run directly on a machine — not because they're untrustworthy, but because they're powerful. Power deserves good defaults.

That's why sandboxing makes sense. When you run docker sandbox run <agent>, the agent operates inside an isolated environment: scoped filesystem access, resource limits, and a clean, reproducible workspace. You still move fast. You're just not exposing everything by default.

What I like about this approach is how practical it feels. Containers already fit the way agents work: rapid iteration, scoped local state, and clear execution boundaries for behavior that isn't always predictable. This isn't about locking things down. It's about giving autonomy a safe place to live.

We're early. This is experimental. But the direction feels right — and I could be wrong on the exact shape, but the principle holds: the default should never be "the agent gets everything the developer has." That's not a workflow. That's an incident waiting to be scheduled.