Coding agents rely on models, runtimes, and tools to act autonomously, but the default setup carries real security risks. Three principal approaches to constraining agent tool access are explored: pre-execution guardrails (permission rules, classifier models, hooks), process sandboxing (OS-level isolation via Bubblewrap, Seatbelt, or Windows Process Containers), and container environments (Docker/dev containers for stronger isolation). Each approach has trade-offs in setup effort, isolation strength, and OS maturity — Windows sandboxing support in particular is still experimental. Model alignment alone is insufficient since models can be jailbroken. The post also raises the question of agent identity and whether agents should operate under their own credentials rather than the developer's. Teams are encouraged to proactively assess their current tool safety posture before an incident forces the conversation.
