Choose the coding tool and the access you are prepared to grant, then copy the matching settings snippet or one-time launch command. This generator puts common starting points for Codex, Claude Code, and Gemini CLI in one comparable interface. Its purpose is to help you avoid treating “can write files” as “will not ask again,” or treating similarly named modes in different products as equivalent protection.

It is for people who already know which AI coding tool they want to use and need a reversible permission baseline. You provide a tool and permission preference; the page returns copyable configuration text or a one-time command, plus the option's limits, risk warnings, and links to primary documentation. It is not an installer and does not change any settings on your computer.

Start with the smallest useful scope

For a first real-project use, choose Manual approval baseline (recommended start) or the tool's human-approval baseline. In a version-controlled, non-sensitive project, complete one small task—such as changing one file, running the existing tests, and reviewing the diff. Only after the workflow is understood should you consider allowing network access or reducing repeated confirmations.

Full access is not a routine efficiency setting. It may remove a sandbox, approval, or both. Even when a tool is allowed to write, administrator settings, existing allow and deny rules, the working directory, and operating-system permissions may still limit it. Each product protects different surfaces; do not transfer one tool's mode name to another tool.

How to use the generator

  1. Choose Codex, Claude Code, or Gemini CLI.
  2. Choose a permission level. If unsure, start with Manual approval baseline (recommended start).
  3. Read the on-screen “What to know” text and red warnings; do not only copy the command.
  4. For a persistent configuration, back up the existing file and manually merge the generated snippet. For a trial, prefer a one-time launch command.
  5. After launch, use a non-sensitive task to verify the actual prompts, writable scope, and network behavior. Then restart the terminal or return to the prior settings.

The generator's code area is copyable. It only places text on your clipboard; it has no sign-in, API key, remote write, or settings-application capability.

Example: let Codex write in the workspace while keeping approval

Choose Codex, then Manual approval baseline (recommended start). The page produces this baseline:

sandbox_mode = "workspace-write"
approval_policy = "on-request"
approvals_reviewer = "user"

For a one-time trial, first open a practice folder with no secrets and run the page-provided command there:

codex --sandbox workspace-write --ask-for-approval on-request -c approvals_reviewer=user

The explicit user reviewer prevents an inherited automatic reviewer from deciding those requests. This is generator output, not a setting already applied to your computer. Inside the CLI, use /status to check the active workspace and permissions. If existing settings or managed policy are present, rely on the effective state. You can create a fictional three-line note and ask Codex to add only summary.md in that folder; then confirm that the original remains unchanged, the summary matches it, and nothing else was modified. When the test is complete, end that session; a normal launch continues using the prior setup.

For persistent settings, back up ~/.codex/config.toml first and merge individual entries rather than replacing the whole file. An environment already using permission profiles must not mix in this legacy sandbox configuration; use the official profiles documentation for the matching form.

Checks before you apply anything

  • Confirm that the current folder is a project you are willing to let the tool read or modify—not your home directory, a credentials directory, or a workspace that mixes client data.
  • Inspect the existing settings file. Do not overwrite an entire TOML or JSON file with a generator snippet.
  • JSON must contain only JSON. The Claude Code and Gemini CLI full-access explanations include comments and CLI commands; do not paste them into a JSON settings file.
  • With Codex, confirm whether you are using legacy sandbox_mode settings or the newer permission profiles. Official guidance says not to mix the two forms.
  • Where device management, centralized settings, or project rules exist, check their precedence first. Personal settings may not be the final effective settings.
  • Network access, additional writable folders, browser sign-in state, and external tools are separate risks. Choosing a mode called “safe” does not make them safe automatically.

The important differences among the three tools

Codex: writable scope and approval are separate settings

In Codex, workspace-write defines where the sandbox may write; it does not mean approval is disabled. The generator's Codex baseline uses approval_policy = "on-request", so actions that go beyond the established scope can still request confirmation. Setting only sandbox_mode to danger-full-access removes the sandbox; it does not automatically change the approval policy. --dangerously-bypass-approvals-and-sandbox bypasses both and should be evaluated only in a separately hardened, isolated environment.

Enabling network_access opens network access inside a workspace-write sandbox; it does not enlarge the writable scope. If another folder is needed, understand the effect of --add-dir or writable_roots first, then make the smallest increment. See Agent approvals and security, Sandboxing, and the CLI command reference.

Claude Code: plan can explore; it is not an OS-enforced read-only sandbox

Claude Code's plan mode is a useful planning starting point, but it should not be described as a state where nothing can run. It can explore and propose actions; whether a command needs confirmation also depends on the session, classifier, and managed settings. For a human-approval baseline, choose default. acceptEdits can automatically accept file edits, while shell commands and existing rules retain their own boundaries.

Claude Code has no one global network switch. Check WebFetch, WebSearch, Bash sandbox outbound domains, and allow rules separately. Native Windows does not support the Bash sandbox, and the Bash sandbox does not cover file tools or MCP. See permission modes, permission rules, settings, and sandboxing.

Gemini CLI: treat it separately from Antigravity CLI

In Gemini CLI, defaultApprovalMode controls approval mode. default asks before file writes or shell commands; auto_edit automatically approves file edits only, while shell commands still ask. Policy Engine can provide finer rules, but it needs separate inspection. The generator's Gemini CLI choices are not Antigravity CLI settings.

Google's announcement says that free-plan and Google One users have moved from Gemini CLI to Antigravity CLI since 2026-06-18. If you use agy or the Antigravity interface, do not copy this page's Gemini CLI gemini command. See configuration, CLI reference, sandboxing, and Policy Engine.

How to revert

Before making a persistent change, copy the original file to a backup location you can identify. If settings are managed in Git, inspect the diff before committing. After a one-time command test, close that terminal and start the tool normally without those arguments. If you edited a settings file, restore the backup or manually remove the keys you added, then restart the tool.

If automatic approval behaves unexpectedly, stop work and inspect the command-line arguments, effective settings source, and any administrator rules. Do not use a higher-permission mode to troubleshoot it. If JSON parsing fails, remove comments and trailing commas, then compare with the complete format in the official documentation.

Limits and common questions

What did the generator test cover?

Browser testing covered switching among 3 tools and 5 options, the original HTML default output, and clipboard round trips. It also checked that 10 Codex TOML snippets and 16 JSON examples parse. That does not mean every setting has run successfully in your operating system, CLI version, company policy, or project.

Why does “full access” mean different things in the three tools?

Sandboxing, approval, file tools, shell, network access, and centralized management settings are not one layer of control. A name is only an interface choice, not a cross-product safety guarantee. Read the generator warning and the relevant official documentation for each tool.

Can I paste Claude Code or Gemini CLI comments directly into settings.json?

No. JSON does not support comments. The page displays the full-access configuration block as explanation to show that it can only be enabled at the command line; it is not text to paste into a JSON settings file.

Why are Cursor and GitHub Copilot not included?

The first version covers only the three CLIs whose official documentation and configuration formats were compared individually for this page. Cursor's official CLI parameter documentation is insufficient, so settings from similar products cannot be assumed correct. Other tools should be added only after primary documentation can be checked and an independent review is complete.

Verification scope

The settings and explanations on this page are based on primary documentation readable on 2026-11-08. Tool versions and permission designs can change quickly and are intended to be checked against official documentation monthly. Before use, still check the current official documentation and your actual version. This page provides comparison and configuration assistance; it does not replace a security policy, organizational management rules, or isolated-environment design.