Coding clients usually offer permission modes: read-only, writes inside the workspace, or the whole disk. Start read-only or workspace-only. Widen for one task, do not leave always-allow on.
Tool approval is not the sandbox. The sandbox blocks surprise paths; approval shows the command or MCP call about to run. Pair this with approve MCP tool calls.
CI and scripts have no click. Fail closed, or allow only a listed tool, instead of silent allow. The log should show denied calls.
After you change the mode, try a prompt that should fail: read a secrets directory or edit a file outside the repo. If it succeeds, tighten it. A listing here is not an audit of those tools.