What it lets the tool do. Shell access means the capability can invoke a shell — bash, zsh, PowerShell, cmd — and run commands that the AI generates. It's the most general-purpose permission: anything the shell can do, the AI can now do. That makes it useful for real work (building, testing, scripting) and the highest-risk permission on the ladder.
What can go wrong. An overly enthusiastic AI can run rm -rf, push a broken branch, install a malicious package, or exfiltrate files to a network endpoint. Even honest mistakes matter when the blast radius is your entire machine and every credential on it.
How to contain it. Never grant shell access on a machine that holds credentials or unbacked work. Prefer capabilities that expose narrow tools — file read, HTTP fetch, one specific API — over ones that expose a shell; the tool boundary is the safety boundary. When shell truly is needed (running tests, building code), use a project-scoped sandbox and revocable session, and review each command before it runs.