{"id":33256,"date":"2026-06-26T09:51:39","date_gmt":"2026-06-26T13:51:39","guid":{"rendered":"https:\/\/www.uvm.edu\/it\/kb\/?post_type=ht_kb&p=33256"},"modified":"2026-08-31T16:47:35","modified_gmt":"2026-08-31T20:47:35","slug":"claude-code-permissions-sandboxing","status":"publish","type":"ht_kb","link":"https:\/\/www.uvm.edu\/it\/kb\/article\/claude-code-permissions-sandboxing\/","title":{"rendered":"Claude Code Permissions & Sandboxing"},"content":{"rendered":" \t\t
\r\n \t\t\tEarly Release Content<\/span> \t\t\t \t\t\t\t

\r\n \t\t\t\t\tThis is an early release of this KB article and content is subject to change. Please refer back to this article occasionally for updated guidance. \t\t\t\t<\/p>\r\n \t\t\t \t\t\t\r\n \t\t<\/div>\r\n \t\t\n

Why do we need permissions and sandboxing?<\/strong>
\n\"\"<\/a>Out of the box, Claude Code has no file restrictions configured, so once you approve a prompt or it runs a shell command it can reach sensitive files such as protected University data<\/a> stored on your computer or authentication keys. Permission rules<\/a> and the sandbox<\/a> help keep unapproved data from being read and sent off the machine, or files from being changed or deleted.<\/p>\n \t\t

\r\n \t\t\tIMPORTANT<\/span> \t\t\t \t\t\t\t

\r\n \t\t\t\t\t<\/p>\n

The most common mistake is assuming the built-in sandbox restricts everything Claude reads. It does not<\/strong>, so it is worth understanding each layer before you rely on it as a boundary.<\/p>\n

\t\t\t\t<\/p>\r\n \t\t\t \t\t\t\r\n \t\t<\/div>\r\n \t\t\n

If you just want a sensible starting point to copy, see the\u00a0example Claude Code sandbox configuration<\/a>, which provides a\u00a0settings.json<\/code>\u00a0with permission rules and sandbox settings already filled in.<\/p>\n

How Claude Code reaches your filesystem<\/h2>\n

Agentic AI platforms like Claude use “tools” to give models different abilities. A “tool” is a specific action the model is allowed to perform on your system, such as reading a file, editing one, or running a terminal command. The model does not touch your machine directly; it requests a tool, and that tool carries out the action, which is exactly why the controls below matter.<\/p>\n

There are two paths<\/strong> to your files. The first is the set of built-in file tools: Read, Edit, Write, Grep, and Glob, which run inside the Claude Code process. The second is the Bash tool and the child processes it spawns, such as\u00a0cat<\/code>,\u00a0python<\/code>,\u00a0npm<\/code>, git<\/code>, etc.<\/p>\n

Each path is governed at a different layer.<\/p>\n