You don't want to ban the model from running sudo. I have Claude working in a VM where it has (and needs) free rein, including sudo.