Claude Code File System Boundaries in 2026: What --add-dir , Allowed Paths, and Sandbox Roots Actually Restrict

This article was written with the assistance of AI, under human supervision and review.

The Filesystem Permission Model Nobody Reads

Teams enable Claude Code in production repositories with --add-dir flags they copied from documentation, then discover the agent reading .env files or modifying sibling project directories during auto mode. The failure stems from conflating two independent permission layers that operate at different abstraction levels.

Problem flow showing Claude Code reading secrets due to misconfigured permissions

The correct model separates sandbox roots (which directories the Bash tool can execute commands inside) from allowed paths (which files Claude's read/write tools can access directly).…