Skip to content

Filesystem access

Filesystem access is controlled by each agent's own permission mode, not a separate AgentDock sandbox.

AgentDock does not layer an independent filesystem sandbox on top of the agents it runs. Filesystem access is a direct consequence of whichever permission mode the active agent is in:

  • Codex's sandbox tiers are the clearest example — read-only genuinely restricts Codex to reading the workspace, workspace-write scopes writes to the current workspace, and danger-full-access removes that restriction entirely.
  • Claude Code and Antigravity gate file writes the same way they gate any other tool call — through the interaction-card flow tied to their current mode (plan restricts changes, acceptEdits/accept-edits allows them without individual prompts, bypassPermissions/bypass skips the check).

Warning

There is no AgentDock-level allowlist or denylist for specific paths or directories. Access is controlled entirely at the agent's mode level, workspace by workspace.

If you want to limit what an agent can touch in a given workspace, the lever is the same one described throughout this section: set a conservative permission mode in Settings → Agents before granting broader access. See Recommended practices.