Configure sandbox and approvals separately
The sandbox technically limits access by executed commands. Approval policy determines when additional confirmation or review is needed. A permissive approval setting does not narrow access; a prompt alone does not provide technical isolation. Check the effective configuration for the chosen host and task, including overriding organisation rules.
Assess connected tools separately
A local coding task can use additional apps, browser access or MCP tools. Include their identities and permissions even when local file access is narrow. Record possible external changes and applicable controls. Run sensitive test cases with suitable substitute data; credentials must appear neither in the diff nor in unnecessary logs.
Test the boundary directly
An allowed task should work inside the intended project. A deliberate boundary test checks forbidden write destinations, unnecessary network access and denied external actions. Evaluate observed behaviour rather than only the displayed setting. Repeat the affected test after permission changes. A successful build does not replace this security check.
Decision matrix
| Decision point | Proceed when | Stop when |
|---|---|---|
| Data and accountability | Documented: workspace boundary, write access, network, secrets and external effect. | Scope, data or accountability remains unresolved. |
| Control evidence | A recorded boundary test shows permitted work in the workspace and handling of forbidden writes, network access or external effects. Secrets appear neither in the result nor in unnecessary logs. | There is only an unevaluated demo without acceptance evidence. |
| Approval boundary | Owner, approval, fallback and next review date are defined. | Avoid: putting convenience ahead of least privilege. If permissions are expanded for convenience without assessing the concrete need and additional effects, the basis for accountable approval is missing. |
Keep it verifiable
Primary sources
- OpenAI: Agent approvals and securitySource checked:
- OpenAI: Model Context ProtocolSource checked:
