Strict Sandboxed Permissions Config

When to use this

Use this configuration file to restrict agent execution within tight security boundaries (read-only filesystem, explicit command whitelists).

The template

{
  "permissions": {
    "file_system": {
      "read": [
        "${workspaceRoot}/src/**",
        "${workspaceRoot}/package.json",
        "${workspaceRoot}/tsconfig.json"
      ],
      "write": [
        "${workspaceRoot}/src/**"
      ],
      "deny": [
        "**/.env*",
        "**/*.pem",
        "**/*.key",
        "~/.ssh/**"
      ]
    },
    "commands": {
      "allowed": [
        "npm run typecheck",
        "npm test",
        "git status",
        "git diff"
      ],
      "require_approval": [
        "npm install*",
        "git commit*"
      ],
      "forbidden": [
        "curl*",
        "wget*",
        "rm -rf*",
        "sudo*"
      ]
    }
  }
}

How to use

Save to .claude/permissions.json or .cursor/permissions.json in your repository.