Module 8 · PermissionsVerified 2 Nov 2026

Permissions & terminal sandbox

Decide how much Copilot may do without asking, and put a fence around the terminal.

Try the dial

Permission dial

Choose a level, then toggle the sandbox

Copilot asks before it runs risky tools. Your approval settings decide what is pre-approved.

Who approves tool calls

You, for each tool call that is not pre-approved

Use when

Unfamiliar repos, production code, learning how the agent behaves.

Control

Speed

Risk

Terminal sandbox on (restricts file and network access for commands, whatever the level)

The risk bar is a simplified illustration, not a security guarantee.

Good to know

Assisted needs a supported session type. It is not offered for every harness, so check what your Permissions picker shows.
Autopilot is a separate idea from the permission level: it also answers the agent's own questions and retries on errors.
The terminal sandbox is independent of the level. Even with Allow all, sandboxed commands stay inside its limits.
A sandbox is not a virtual machine. For truly untrusted code, use a Dev Container or a cloud session.

Sandbox requirements

Turn it on in the Permissions picker under “Sandboxing for terminal”, or with a setting.

Sandbox platform support
Platform	Requires	Notes
macOS	macOS 15 or later (Seatbelt)	Built in
Linux / WSL2	bubblewrap 0.5+, slirp4netns, util-linux 2.35+, iptables	Install packages; musl and WSL1 are not supported
Windows	Windows 11 with the documented baseline	Check the VS Code docs for the current requirements

settings.json recipes

Cautious: unknown repository

.vscode/settings.json

{
  "chat.agent.sandbox.enabled": "on",
  "chat.agent.sandbox.network.allowNetwork": false,
  "chat.tools.terminal.autoApprove": {
    "git status": true,
    "git diff": true,
    "rm": false
  }
}

Balanced: your own project

.vscode/settings.json

{
  "chat.agent.sandbox.enabled": "on",
  "chat.tools.terminal.autoApprove": {
    "npm test": true,
    "npm run lint": true,
    "/^git (status|diff|log)/": true,
    "rm": false,
    "curl": false
  }
}

Fast: disposable branch or container

.vscode/settings.json

{
  "chat.agent.sandbox.enabled": "on"
}
// Then choose Allow all or Autopilot in the Permissions picker.
// Work on a fresh git branch and review the whole diff before merging.

Before you press go

☐ Work on a git branch so you can discard everything.
☐ Turn the terminal sandbox on before choosing Allow all or Autopilot.
☐ Keep secrets out of the workspace (.env files, tokens).
☐ Deny destructive commands (rm, curl piped to sh) in the terminal auto-approve list.
☐ Set a clear finish line: a test command that must pass.
☐ Read the full diff before you commit.

A sandbox is not a virtual machine

For untrusted code, use a Dev Container or a cloud session as well.