Architecture decision

Permissions vs Prompt Guardrails

Which safety boundaries belong in instructions, and which require platform enforcement?

Get the short answerReview evidence

The short answer

State the operating policy once in instructions, then enforce consequential boundaries outside the model with the narrowest available permission and approval controls.

Choose

Permissions and safety

The trust boundaries that constrain what an agent can read, execute, change, publish, purchase, or send on a user's behalf.

  • The action reaches production, money, credentials, external people, or destructive state.
  • A compromised or confused model must still be unable to exceed authority.
  • The organization needs auditable allow, deny, and approval decisions.
Open the Permissions and safety guide

Choose

Repository instructions

Durable, version-controlled guidance that tells coding agents how a repository is organized, how to verify work, and which boundaries matter.

  • The agent needs guidance about scope, escalation, or preferred behavior.
  • Several safe actions require contextual judgment rather than a fixed block.
  • The instruction helps the model explain why it stopped or requested approval.
Open the Repository instructions guide
Use both

How the layers combine

  1. 01

    Define the authorization model concisely in shared instructions.

  2. 02

    Map sensitive action classes to credentials, sandboxes, and approval gates.

  3. 03

    Log both the model's requested action and the platform's enforcement decision.

Decision review

Questions to answer before implementation

  • What user request or policy authorizes each side effect?
  • Can instruction failure bypass the critical boundary?
  • Are credentials limited to the current task and environment?
  • Can operators revoke access and reconstruct the run?
  • Are safe local actions still usable without unnecessary friction?

Evidence ledger

Primary documentation for both sides

Reviewed July 26, 2026. Use the provider documentation for current configuration and security behavior.

Codex security

OpenAI

Sandboxing, approvals, network access, and security boundaries in Codex.

Configure permissions

Anthropic

Claude Code permission rules, modes, hooks, and managed policy.

AGENTS.md specification and examples

AGENTS.md

The portable AGENTS.md format and repository instruction pattern.

Codex AGENTS.md guidance

OpenAI

Codex discovery, precedence, scope, and maintenance guidance.

How Claude remembers your project

Anthropic

CLAUDE.md locations, loading behavior, concise instruction guidance, and AGENTS.md interoperability.