审批、沙箱和 Checkpoint 有什么区别？
审批是交互策略：Agent 准备做某件事时问你。沙箱是执行隔离：即使操作被批准或模型判断错误，进程仍被限制在特定文件、网络和系统能力内。Checkpoint 是恢复工具：它能回滚部分文件或会话，但通常不能撤销已发送的数据、已推送的提交、云资源变更或泄露的密钥。
Approval, sandbox or checkpoint?
Approval is an interaction policy: the agent asks before an action. A sandbox is execution isolation: even after approval or a bad model decision, the process remains bounded by filesystem, network and system controls. A checkpoint is recovery: it may restore files or task state, but usually cannot undo sent data, pushed commits, cloud changes or exposed secrets.
| 能力 / Capability | 默认风险 / Risk | 建议 / Safe default |
|---|---|---|
| 读取工作区 / Read workspace | 低 / Low | 可自动批准，排除密钥文件 / Auto-approve with secret exclusions |
| 修改工作区 / Edit workspace | 中 / Medium | 保持 Git 干净并审查 diff / Clean Git state and review diff |
| 运行 Shell / Run shell | 高 / High | 逐次批准或放入容器 / Approve or isolate in a container |
| 访问工作区外文件 / Outside files | 高 / High | 默认拒绝 / Deny by default |
| 浏览器与网络 / Browser and network | 高 / High | 按域名开放，禁止任意外发 / Allowlist destinations |
| MCP 工具 / MCP tools | 高 / High | 逐个服务器和工具授权 / Scope each server and tool |
| YOLO / Full auto | 极高 / Critical | 只在一次性隔离环境使用 / Disposable isolation only |
十分钟安全配置
- 从干净仓库开始：先提交或暂存自己的修改，确保之后能区分 Agent 的变更。
- 限制文件范围：只开放当前工作区；明确排除
.env、SSH、云凭据、浏览器资料和个人目录。 - 写入和命令保留审批：读取与搜索可以自动批准，安装依赖、删除、Git push、部署和系统设置必须询问。
- 不可信仓库放进容器：陌生仓库可能通过脚本、工作区设置或依赖安装触发命令。
- 网络按需开放：无联网需求就关闭；需要联网时只允许文档、包仓库和任务必要的 API。
- 密钥留在执行边界外：使用短期、最小权限凭据，通过代理或密钥管理器注入，完成后撤销。
- MCP 做减法：禁用当前任务不需要的服务器；对写操作、消息发送、支付和云资源变更始终保留确认。
- 结束前检查：运行测试、审查 diff、确认没有新增密钥、陌生依赖和计划外网络请求。
什么时候可以自动批准？
适合自动批准的是可逆、只读、范围明确的动作，例如列目录、搜索代码、读取公开文档和运行已知的只读检查。命令名字看起来安全并不够：参数、工作目录、项目内同名可执行文件和安装脚本都可能改变结果。
不要把“我信任这个 Agent”当成理由。你真正需要信任的是完整链路：模型输出、Agent 运行时、当前仓库、依赖、插件、MCP 服务器、网络目标和凭据范围。
发现异常操作怎么办？
- 立即停止 Agent 和相关后台进程，先不要继续尝试“自动修复”。
- 断开网络或销毁一次性容器，撤销本轮可接触的 API Key、OAuth 和云凭据。
- 检查 Git diff、未跟踪文件、Shell/Agent 日志、依赖锁文件和外部服务审计记录。
- 从已知干净状态恢复代码；Checkpoint 可以辅助，但不能替代凭据轮换和外部系统核查。
- 缩小权限后重新执行最小任务，并保留人工确认和日志。
来源与适用边界
隔离、网络和凭据原则参考 OpenAI 官方 Sandbox Security；审批建议参考 Cline Auto Approve 文档；“权限提示不是沙箱”的边界参考 OpenCode 官方安全说明。不同产品的具体默认值会变化，使用前应重新检查当前版本。
A ten-minute safe setup
- Start from a clean repository: commit or stash your own work so agent changes remain distinguishable.
- Bound filesystem access: expose only the workspace and exclude
.env, SSH, cloud credentials, browser profiles and personal directories. - Keep approval for writes and commands: reads and search may be automatic; installs, deletion, push, deploy and system settings must ask.
- Put untrusted repositories in containers: scripts, workspace settings and dependency installation can execute code.
- Open network access only when needed: allow documentation, package registries and task-specific APIs rather than arbitrary egress.
- Keep secrets outside the execution boundary: inject short-lived, least-privilege credentials through a broker or secret manager and revoke them afterward.
- Minimize MCP: disable unused servers and require confirmation for writes, messages, payments and cloud changes.
- Inspect before finishing: run tests, review the diff and check for secrets, unfamiliar dependencies and unexpected network calls.
What can be auto-approved?
Good candidates are reversible, read-only and tightly scoped: listing files, searching code, reading public documentation and known read-only checks. A command name alone is not enough. Arguments, working directory, repository-local executables and install scripts can all change its behavior.
Do not rely on “trusting the agent.” The actual trust chain includes model output, runtime, repository, dependencies, plugins, MCP servers, network destinations and credential scope.
What if something looks wrong?
- Stop the agent and background processes. Do not ask the same agent to repair the incident yet.
- Disconnect networking or destroy the disposable container; revoke API keys, OAuth grants and cloud credentials exposed to the run.
- Inspect Git changes, untracked files, shell and agent logs, lockfiles and external audit records.
- Restore from a known clean state. Checkpoints may help, but cannot replace credential rotation or external-system review.
- Retry the smallest task with narrower permissions, human approval and logging.
Sources and scope
Isolation, network and credential principles follow OpenAI's official Sandbox Security guide. Approval advice follows Cline's Auto Approve documentation. The boundary between permission prompts and isolation follows OpenCode's official security notes. Product defaults change; verify the current version before use.