In the last post, I described the first thing to do before you run an AI assistant like Claude Code: make one folder for your AI-assisted work, and start the assistant only from inside it. That habit costs nothing, and if it is the only thing you ever do, you have gone a long way toward protecting your privacy and security. But a habit is only as good as your memory of it. It holds as long as you remember to start in the right folder, and as long as the tool treats that folder as its boundary. If your computer or your cloud folders hold material other people are counting on you to protect — a professor’s graded work, a clinician’s case notes, a researcher’s confidential transcripts — you want a boundary that does not depend on either of those things. You want one the computer itself enforces. It turns out there are two of these boundaries. This post is about what they are and why you need both; the next post is about how to set them up.
I want to be clear that this post is not for careless people who aren’t bothered by what an AI assistant is doing on their computer. It’s for the conscientious people who happen to hold other people’s confidential information and would never dream of handing it over to an AI. The hazard is not that you might do something reckless. It is that the sensitive files are already on your computer, already reachable by the AI assistant — and there is no announcement of this fact when you are using a tool like Claude Code. The goal here is to understand how to make sure Claude Code cannot reach folders or files to which you have not deliberately given it access.
The first thing that surprised me, when I set this up with help, is that there is not one way for your computer to enforce a fence, but two. That’s because Claude Code (or any other AI assistant) can act on your computer in two different ways. This means each way needs its own fence.
Fence number one: Sandbox for commands
The first fence is called a sandbox. A sandbox fences in commands: short instructions (“code”) that tell the computer’s own machinery to carry out a specific task. Commands are the computer programmer’s bread and butter, and Claude Code is great at them. Commands are how it does the heavier, more mechanical jobs, the kind you would never do by hand. For example, as part of my research on nonprofit organizations I had a spreadsheet of about 10,000 New York City nonprofits. I asked Claude Code to find the highest-paid employee at each one and tell me how many of them earned at least 10% of their organization’s budget. To do that, it wrote and ran commands. I did not write them, and although they scrolled past in my Terminal app, I could not have told you what any one of them did. What I saw was the answer — roughly 1,400 organizations — and the tidy output spreadsheet that Claude Code created. The actual work, reading through all the underlying data and weighing every salary against every budget, happened out of sight in response to Claude Code’s commands.
Commands do lots of powerful work, and a sandbox is a cage your computer’s operating system puts around those commands. The sandbox limits two things: where a command is allowed to reach on your computer, and where it is allowed to reach on the internet. When you make a sandbox, you can tell Claude Code where it’s allowed to run commands: for example, only inside your AIWorkspace folder. So when I had Claude Code work on my nonprofit project, I made sure the spreadsheet with the data was in my AIWorkspace folder, where Claude Code could write commands to access and analyze it. When the results were ready, they showed up in that same folder. But if a Claude Code command had tried to reach into my Documents or my Box folder, my computer’s operating system would have automatically refused it. And on the internet side, the sandbox works from a list of allowed addresses: anything not on that list is refused, whether Claude Code is trying to send my data out or to pull something down and run it on my computer. So the sandbox is a cage that holds whether or not you are watching. A command that tries to step outside the cage is stopped.
Fence number two: Permission rules for Claude Code’s “hands”
But running commands is not the only way Claude Code touches your files. It also has a built-in set of tools for opening a file, reading what’s in it, and writing changes back. In my conversations with Claude Code, it often refers to these built-in tools as its “hands.” When Claude Code puts its “hands” on your files, it means it’s picking up and working with those files directly, not writing commands to (indirectly) work with your files. It is an odd distinction, but the implications for how to fence in Claude Code are significant. It means that not only do you need a sandbox, you also need a second kind of fence. Here’s why.
By default, Claude Code’s “hands” can reach any file you can reach, anywhere on your computer. The folder you launch in (e.g., AIWorkspace) is where Claude Code starts and does most of its work, but it is not a wall around what its “hands” can touch. Ask it to “grab the spreadsheet from my Downloads” or “pull up the notes on my Desktop,” and its “hands” can go and get them. More importantly, in the middle of running a longer task you’ve set it to, Claude Code may decide it needs something well outside your AIWorkspace folder and reach for that too. None of this goes through the sandbox: the sandbox watches commands, and reaching for a file directly is a different kind of action that slips past it untouched.
So the second fence you need is a set of permission rules: a plain list of what Claude Code’s “hands” may and may not open. Mine allow my one AIWorkspace folder and deny, by name, the places where sensitive material lives: my Documents, Desktop, and Downloads folders; my cloud-synced Box and Dropbox; my saved keys and passwords; even the stored transcripts of my own past sessions. If Claude Code tries to open any of those, its “hands” are stopped before anything happens.
The takeaway
If you hold data that other people are counting on you to protect, you want the two fences your computer enforces on your behalf: a sandbox for the commands Claude Code runs, and permission rules that make clear the files it can and can’t open. Between them, these fences bound what Claude Code can reach — whether or not you are paying attention.
That leaves the practical question: how to get the fences in place if you are not a technical person, and whether it is something you can do yourself. It is, mostly.
Next: how to set up both fences without writing a line of code — and how to confirm they are really there.