Permissions and Security Models

The three tools take different approaches to safety: Claude Code centers on permission modes + rules (with an optional sandbox), Codex on a mandatory OS sandbox + approval policies, and Kimi Code on permission modes + rules with no documented OS sandbox.

Permission modes

Claude Code — six modes

Mode	Behavior
`default` (labeled Manual in UIs)	Prompts on first use of each tool
`acceptEdits`	Auto-accepts file edits and common filesystem commands within the working dir
`plan`	Read-only exploration; doesn’t edit source files
`auto`	Auto-approves tool calls with background safety classifier checks; the default mode since August 2026
`dontAsk`	Auto-denies tools unless pre-approved via allow rules
`bypassPermissions`	Skips permission prompts; intended only for isolated environments (containers/VMs)

Switch interactively with Shift+Tab; set the startup mode with --permission-mode <mode> or the permissions.defaultMode setting. Admins can disable bypass mode entirely via permissions.disableBypassPermissionsMode in managed settings.

Codex — approval policy × sandbox mode

Codex separates when to ask from what is allowed:

Approval policies (approval_policy / -a): untrusted (only known-safe reads run automatically), on-request (ask when escalation beyond the sandbox is needed; default for the interactive Auto preset), never (never ask; for non-interactive runs), or a granular per-category table. on-failure is deprecated.
Sandbox modes (sandbox_mode / -s): read-only, workspace-write, danger-full-access (see next section).
Verified presets: Auto = --sandbox workspace-write --ask-for-approval on-request (recommended for version-controlled folders); CI read-only = --sandbox read-only --ask-for-approval never. approvals_reviewer = "auto_review" routes eligible approval prompts through an automatic reviewer agent.
/permissions changes the mode mid-session.

Kimi Code — three modes

Mode (0.41.0 name)	Config value	Behavior
Always Ask (formerly Manual)	`manual`	Default. Read-only ops run automatically; every edit/command asks one by one
Ask When Needed (formerly YOLO)	`yolo`	Auto-approves routine calls; still asks for sensitive files (`.env`, SSH keys), dangerous commands, and plan-mode exits
Never Ask (formerly Auto)	`auto`	Fully unattended; everything is decided automatically and the agent never asks questions

Switch with /permission, /yolo, /auto; launch with --yolo / --auto; default via default_permission_mode. A dangerous-command guard (on by default) blocks or asks about commands like shutdown and rm -rf in Always Ask and Ask When Needed modes; in Never Ask mode such commands run without interruption. Disable it with [permission] dangerous_command_guard = false (not recommended).

Sandbox availability per platform

Platform	Claude Code	Codex	Kimi Code
macOS	⚠️ Optional sandbox (`sandbox.enabled`, default off)	✅ Seatbelt via `sandbox-exec`	❌ None documented
Linux	⚠️ Optional sandbox (default off)	✅ `bwrap` + seccomp (WSL2 works; WSL1 unsupported)	❌ None documented
Windows	⚠️ WSL2 only	✅ Native Windows sandbox (`elevated`/`unelevated`) or Linux sandbox under WSL2	❌ None documented

Codex’s sandbox is on by default and enforced by the OS; even in workspace-write, <root>/.git, <root>/.agents, and <root>/.codex stay protected read-only (which is why git commit may still require approval). Network access is off by default in workspace-write (sandbox_workspace_write.network_access = true to opt in).
Claude’s sandbox adds network domain allowlists (network.allowedDomains) and autoAllowBashIfSandboxed (default true: sandboxed Bash runs without prompting). Filesystem/network restrictions otherwise rely on Read/Edit/WebFetch permission rules, not sandbox settings.
Kimi Code’s documented safety model is permission approvals plus hooks — and hooks are fail-open (any non-zero exit other than 2, or a timeout/crash, allows the action), so the docs warn they should not be the sole security barrier.

Rule syntax examples

Claude Code (settings.json `permissions`)

Evaluation order is deny → ask → allow, first match wins. Format: Tool or Tool(specifier).

{
  "permissions": {
    "allow": ["Bash(npm run build)", "Bash(git log *)", "WebFetch(domain:example.com)"],
    "ask": ["Bash(git push *)"],
    "deny": ["Read(./.env)", "Skill(deploy *)"]
  }
}

Specifiers support exact matches, prefix wildcards (trailing *), and parameter matching (Tool(param:value)). Compound shell commands require every subcommand to match an allow rule. “Yes, and don’t ask again” saves Bash/WebFetch rules permanently to .claude/settings.local.json.

Codex (execpolicy `.rules` files, experimental)

Starlark rules in a rules/ folder next to a config layer (e.g. ~/.codex/rules/default.rules, <repo>/.codex/rules/). Most restrictive decision wins (forbidden > prompt > allow).

prefix_rule(
    pattern = ["git", "push"],
    decision = "prompt",
    justification = "Pushing requires human confirmation",
)

Test rules with codex execpolicy check --rules <file> -- <cmd>. Choosing “always allow” in the TUI writes to ~/.codex/rules/default.rules. Named permission profiles ([permissions.<name>]) also support filesystem and network rules with extends.

Kimi Code (`[[permission.rules]]` in config.toml)

First match wins; MCP tools match by name only, with */** wildcards (e.g. mcp__github__*).

[[permission.rules]]
pattern = "Bash(rm -rf*)"
decision = "deny"
scope = "user"
reason = "No recursive deletes"

[[permission.rules]]
pattern = "mcp__github__*"
decision = "ask"

decision is allow/deny/ask; scope is turn-override/session-runtime/project/user (default user).

Bypass flags — use with caution

Tool	Flag	Effect
Claude Code	`--dangerously-skip-permissions`	Skips all permission prompts; docs recommend it only for isolated environments (containers/VMs)
Codex	`--dangerously-bypass-approvals-and-sandbox` (alias `--yolo`)	No sandbox, no approvals; docs flag it “Elevated Risk, not recommended” and advise a dedicated sandbox VM
Kimi Code	`--auto` (Never Ask)	Fully unattended: everything runs automatically, including commands the dangerous-command guard would otherwise block; `-p` non-interactive mode defaults to this
Kimi Code	`--yolo` (Ask When Needed)	Skips approval for routine calls including file writes and shell commands; docs warn to use only in trusted working directories

Note the naming collision: Codex’s --yolo disables the sandbox entirely, while Kimi’s --yolo keeps approval prompts for sensitive and dangerous actions. They are not equivalent.

Recommendations

Never disable protections by default. Keep approval prompts on for anything outside a throwaway environment; reserve bypass flags for ephemeral containers/VMs with no credentials.
Prefer the least-privilege everyday setup: Claude Code default/plan modes (or auto, which still runs classifier checks), Codex’s Auto preset (workspace-write + on-request), Kimi’s Always Ask or Ask When Needed.
Prefer --add-dir (Claude/Codex/Kimi) to widening the sandbox or permission mode when the agent needs an extra directory.
Encode standing policy as deny rules (Read(./.env), Bash(rm -rf*), mcp__* restrictions) instead of relying on ad-hoc rejections.
Do not treat hooks as a security boundary in Kimi Code — they are fail-open by design.
Only trust project folders (workspace trust prompts, project MCP servers) after reviewing what the project config actually enables.

Last verified: 2026-09-07

Official sources:

AI coding tools evolve quickly. If you find outdated information, please open an issue or pull request.