Permissions and Real Security Boundaries: Sandboxes, System Calls, and Approval Escape
Any AI agent permission system running in userspace that relies on model self-discipline and application-level regex filtering does not constitute an enforceable security boundary from the perspective of the operating system kernel. Claude Code’s 5-level permission model and interactive approval workflow operate as flow-control protocols to mitigate developer mistakes, lacking sandbox containment against adversarial attacks. Granting an AI coding assistant filesystem write access and terminal execution rights under the belief that confirmation prompts preserve a safety perimeter is a fundamental category error. Confusing interactive human approval with privileged access control collapses into a cosmetic barrier when confronted with supply-chain poisonings, indirect prompt injections, and shell parser differentials.