A writable root is the top-level directory tree an application is allowed to change inside its assigned workspace. Everything outside that root should be read-only or blocked. This boundary is a core part of sandboxing because it defines where writes, deletes, renames, and file creation are permitted.
In cyber security, writable roots matter because broad write access can turn a small mistake into data loss. AI coding agents, build tools, and automated scripts often need filesystem access, but if their writable root is too large, they may overwrite project files, delete user data, or modify configuration outside the intended task. Defenders limit the writable root to the smallest possible folder, separate workspaces from personal directories, and use approval prompts, backups, and version control to reduce damage if an agent behaves unexpectedly.