Claude Code Permission Modes in 2026: What --allowedTools, Whitelists, and Sandbox Boundaries Actually Restrict
This article was written with the assistance of AI, under human supervision and review.
Most Claude Code security failures stem from treating permission modes and sandbox boundaries as interchangeable concepts. Teams ship agents with Auto mode enabled, assuming the Bash sandbox prevents harm. The sandbox restricts file system access. Permission modes control whether Claude even attempts the action. When these two layers misalign, the agent either breaks production workflows or leaks credentials through unrestricted tool calls.
The confusion compounds when engineers discover --allowedTools and assume whitelisting individual capabilities (like edit_file or run_command) provides complete protection. It does not. The whitelist prevents Claude from invoking forbidden tools. It says nothing about what those allowed tools can reach once invoked. A configuration that permits run_command but forgets to restrict the Bash sandbox to a safe directory tree lets the agent execute rm -rf / without friction.
The correct architecture separates concerns. Permission modes (Auto, Prompt, Restricted, Custom) decide whether Claude asks before acting. Sandbox boundaries (bubblewrap on Linux, Seatbelt on macOS) define the outer limits of what Bash commands can touch. Defense-in-depth pairs permission deny rules with tight sandbox restrictions so even a prompt-approval mistake cannot escape isolation.
