Module 5 — Permissions, Sandboxing & Safety

The harness you built in Module 1 is a security incident waiting for a trigger. It reads a model's tool call, extracts a command string, and hands it to a shell. There is no check between "the model said this" and "the operating system did this." That gap is the subject of this module. It matters because the model is not the attacker — it is the confused deputy. It holds your filesystem access, your API keys, and your network egress, and it will faithfully act on instructions arriving inside a README, a dependency's install script, a fetched web page, or a commit message written by someone who is not your user. Every mechanism here exists to bound the damage when the model is convinced to do the wrong thing, because eventually it will be. This is defensive material: we describe attack shapes so you can design against them, and we are honest that part of this problem — prompt injection above all — has no complete solution today.

Learning objectives

• M5.1 Model the threat surface: prompt injection via tool results, over-broad file access, destructive commands, exfiltration.
• M5.2 Design a permission model — allow/deny/ask, rule matching, scope, and persistence of grants.
• M5.3 Implement approval flows and permission presets without training users to click "yes".
• M5.4 Apply filesystem policy: workspace roots, path traversal defence, and read/write asymmetry.
• M5.5 Sandbox execution — OS primitives (Landlock, seatbelt), containers, and remote sandboxes; know each one's escape surface.
• M5.6 Defend against untrusted content: treat tool output as data, never instructions.
• M5.7 Handle credentials and secrets — never in context, never in logs.
• M5.8 Apply defensive patterns as a review checklist for any new capability.

Prerequisites and time

Prerequisites: Modules 1–4. You need the Module 1 spine available to modify, the Module 3 tool pipeline, and Module 4's session event log — several mechanisms here are defined as events rather than in-memory flags, and the reasoning only lands if you already accept that replaying the log is the state.

Estimated time: 5 hours — roughly 3 hours reading, 2 hours on the lab.

Scope note. This module teaches architecture and threat modelling. It contains no working exploit code; attacks are described at the level a defender needs to build the countermeasure, and no further.

---