# From a Large Allowlist to Three Denials: Permissions for a Coding Agent

DevFeed: [From a Large Allowlist to Three Denials: Permissions for a Coding Agent](<https://devfeed.tech/articles/from-a-large-allowlist-to-three-denials-permissions-for-a-coding-agent-34096.md>)

Original publisher: [Read original article](<https://philipptheserver.com/posts/agent-permissions-inversion/>)

Author: Philipp Lehmann (philipp.lehmann@gruppe.ai)

Published: 2026-08-11T07:00:00Z

Content type: opinion

Language: en

Sources: [Philipp Lehmann](<https://devfeed.tech/sources/philipp-lehmann.md>)

Topics: [coding](<https://devfeed.tech/topics/coding.md>), [Bash](<https://devfeed.tech/topics/bash.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [mount](<https://devfeed.tech/topics/mount.md>), [Network](<https://devfeed.tech/topics/network.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [agents](<https://devfeed.tech/tags/agents.md>), [coding](<https://devfeed.tech/tags/coding.md>), [command-line](<https://devfeed.tech/tags/command-line.md>), [curl](<https://devfeed.tech/tags/curl.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [linux](<https://devfeed.tech/tags/linux.md>), [mount](<https://devfeed.tech/tags/mount.md>), [network](<https://devfeed.tech/tags/network.md>), [permissions](<https://devfeed.tech/tags/permissions.md>), [sandboxing](<https://devfeed.tech/tags/sandboxing.md>), [security](<https://devfeed.tech/tags/security.md>), [shell](<https://devfeed.tech/tags/shell.md>)

## AI overview

The article argues that command allowlists are a poor security boundary for coding agents because the required command set continually expands and command names do not constrain effects. It proposes enforcing limits at the kernel level with Linux namespaces, a read-only root filesystem, scoped writable mounts, and dropped capabilities, allowing a shell to run while restricting its blast radius.

## Source excerpt

bwrap --unshare-net --cap-drop ALL instead of a command allowlist: sandboxing a coding agent's shell so rm -rf and curl cannot leave the workspace.