Chapter 5: What Keeps the Agent Safe
Model decides to clean up temp files. Generates rm -rf /. Bash tool executes it. No confirmation. No sandbox. Your filesystem is gone. This isn't hypothetical. It's the default without permission gates.
The fix: put a gate between the model's intent and the tool's execution. Three flavors: Auto (safe, let it through), Ask (pause for human approval), Sandbox(run in isolation, can't escape).
Click any tool to see its gate in action. Read-only tools auto-approve. File-modifying tools need confirmation. System-level tools run in a sandbox.
The tier determines the gate, not the model, not the user. The harness.
The model (brain) runs in unrestricted space. It can think anything. The execution (hands) runs in a sandboxed boundary. The gate wall ensures that thinking about rm -rfcan't become doing it without passing through permission checks.
Claude Code uses an allowlist plus bash sandboxing. Cursor asks per file write. Manus runs everything in a full VM. The model literally can't affect the host machine. Different trade-offs, same principle: gates on wires.