IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Permissions, sandboxes and secrets
Priya's coding agent read a bug report. A hidden line told it to paste her secret .env file into its reply. It was fooled. Your goal: make a fooled agent harmless.
🧪 Interactive lab — enable JavaScript to play with this one.
- A coding agent runs commands as you.
- Allow routine steps. Ask about risky ones. Deny what must never happen.
- Keep secrets where the agent can't read them.
- Git undoes file changes. It can't undo a leaked key.
Allow, ask, deny
Your coding tool checks each action against a list of permission rules. Each rule names an action and a verdict.
| Verdict | Use it for |
|---|---|
| Allow | Routine and easy to undo: run the tests, git status, git diff, edit project files. |
| Ask | Reaches out, or hard to undo: install packages, fetch web pages, git push. |
| Deny | Must never happen: read secret files like .env, rm -rf, deploy. |
Why not ask about everything? After many harmless questions, you click "yes" without reading. This is approval fatigue. So allow routine steps, and each question left is worth reading.
A sandbox is a fence
A rule checks the words of a command, not what it does. So add a fence the computer enforces: an agent sandbox. Think of a practice kitchen with locked doors. A new cook can make a mess inside, but cannot reach the cash box or phone. A sandbox limits which files a command can change. It can also block the network (internet access), except a few sites. Then a fooled agent can't send your data out.
Keep secrets out of reach
Anything the agent reads goes to the model. So keep keys out of the code and the chat. An environment variable keeps a key out of your files. But the agent's commands may still see it. So give the agent its own narrow, short-lived key. If a key leaks, rotate it: make a new key and turn off the old one. Copies live on in git history and logs.
Now choose what a fooled agent can reach.
🧪 Interactive lab — enable JavaScript to play with this one.
Go deeper: permission modes
Each tool also has a permission mode: what the agent may do without asking. Names differ by tool.
| Mode | Runs without asking |
|---|---|
| Plan / read-only | Reading only. Nothing changes. |
| Ask every time | Nothing. Each edit and command waits for you. |
| Auto-accept edits | File edits. Commands still ask. |
| Allowlist | Only named safe commands, like running tests. |
| AI-reviewed | Most actions. A second AI blocks the risky ones. |
| Full auto | Everything. Only for a throwaway sandbox. |
As of October 2026, Claude Code, Cursor and Codex all have an AI-reviewed mode. Claude Code's docs say it is the starting mode for terminal sessions (version 2.1.283 or later). Cursor's docs say it "is not a security boundary." It is a smarter filter, not a wall.
Full auto flags have clear names, like --dangerously-skip-permissions. Malware has used them to turn a coding agent against its owner. Use them only in a throwaway container with no secrets and no network. Never pre-approve commands that delete files, rewrite git history, deploy or send data out.
Go deeper: what git undoes
Git covers only files in the repository. It can't bring back a folder outside it, a deleted database, a sent email or a leaked key. It can't bring back teammates' commits lost to a force-push either. Branch protection, backups and deny rules cover those.
| Layer | Stops | Misses |
|---|---|---|
| Rules | Known bad commands, by name | The same action written another way |
| Asking you | What you really read | What you approve without reading |
| Sandbox | Writes outside the project, blocked sites | Harm inside the project, data sent to an allowed site |
| Narrow keys | Damage beyond what the key can reach | Misuse of what it can reach |
| Git | Bad edits to tracked files | Anything outside the repository |
Go deeper: how attacks get in
Hidden orders can come from anything the agent reads: issues, READMEs, web pages and tool descriptions. This is prompt injection, as you saw in Prompt injection. In May 2025, researchers showed it with a public GitHub issue. The issue steered an agent that could also reach private repositories. It leaked data from them. No prompt fully fixes this.
Attacks also hide in what you install. A package the model "remembers" may belong to an attacker (Review AI-written code). Some harm needs no attacker at all. In July 2025, a founder said an AI agent deleted his production database. OWASP calls the root cause excessive agency: too many tools, permissions and freedom.
Go deeper: rules and sandboxes
In Claude Code, for example, Bash(npm run test *) on the allow list lets tests run. Read(./.env) on the deny list blocks its file tools. In most tools, deny wins over allow.
Rules match text. A deny rule for curl stops curl https://example.com. It may not stop sh -c 'curl https://example.com'. A script that opens .env itself also gets past the rule. So pair rules with a sandbox. In Claude Code, the sandbox then applies the same rule to every command and the programs it starts. Hooks and MCP servers still run outside it.
A sandbox often still lets commands read files outside the project, like cloud keys. The network setting is what stops data going out. Sandboxes can use the operating system, a container, a dev container or a throwaway virtual machine.