BLOG ILLUSTRATION / EXECUTION STORY

Approved commands and sandbox limits

Compare an installation already allowed by permission rules, one requiring approval for specific access, and one denied before execution. The process-start count changes only when an allowed process starts.

Approved commands and sandbox limitsPermission rules check an installation request. An allowed request runs inside sandbox limits; a request needing approval waits for specific access, while denial returns a blocked result without starting a process. A completed process returns its actual result. Approved commands and sandbox limits Tool call Install task Permissions Rule check Approval This install Process Sandbox limits Blocked Not started Tool result Actual result Allow Ask Deny Approved
Permission rules let an installation proceed, ask for approval of specific access, or block it before a process starts. Author-created teaching scenarios, not security test results, a product policy order or a security guarantee. Playback time is not command latency. Open full-size SVG