Permission Denied: Policy-Graded Evaluation of Coding Agents in Hardened Environments

The paper reports an evaluation of 12 coding agents on Terminal-Bench 2.1 under nested security policies modeled on enterprise controls, including scoped credentials, restricted egress, read-only filesystems, and non-root execution. Under the strictest policy, the largest reported success loss is 18.3 percentage points and cost inflation reaches 167.3%. Success retention and efficiency do not rank models consistently, while blocked actions often lead to timeouts or incorrect solutions. The authors also describe Boundary-Bench, an open-source hardening plugin. However, the supplied publication date is August 2026, so the paper and release cannot currently be independently verified.