Permissions and safety with agents
Permission modes, why deny rules matter more than instructions, and the specific risks of an agent that can run shell commands.
Modes and rules
| Mode | Behaviour | When to use |
|---|---|---|
| default | Asks before edits and commands | Everyday work, especially in unfamiliar code |
| plan | Reads and proposes; makes no changes | Scoping a change before agreeing to it |
| acceptEdits | Applies file edits without asking | A committed tree and a task you already reviewed |
| bypassPermissions | Skips prompts entirely | Only inside a disposable container or sandbox |
claude --permission-mode plan
# A narrow allow-list beats a broad mode: allow the commands you actually use
# "allow": ["Bash(npm test)", "Bash(npm run lint)", "Bash(git diff:*)", "Read(./src/**)"]
# "deny": ["Read(./.env)", "Bash(rm -rf:*)", "Bash(git push --force:*)"]- Deny rules are checked by the tool layer; instructions in a prompt file are not enforced. Put anything non-negotiable in
deny. - Deny secrets by path:
.env, key files, credential stores and anything the agent only needs to know the name of. - Deny the irreversible commands by name: force push, recursive delete, database migration and anything that deploys.
- Use
askfor the actions that are fine sometimes, such as installing a package or pushing a branch.
Risks specific to a terminal agent
- Injection through content. A web page, an issue description or a file the agent reads can contain instructions addressed to it. The model cannot reliably separate data from instructions, so fetched content must never be able to authorise an action.
- Overtrusting the summary. The agent reports success in prose. Verify with the command output, not with the narrative.
- Secret exposure. Anything in context can end up in a transcript, a log or an outbound request. Keep credentials in the tool layer, not in files the agent reads.
- Wide blast radius. A shell tool is a shell. Without a sandbox, a mistaken command can delete work outside the repository.
- Third-party tool servers. An MCP server is code you are choosing to run with the agent's reach. Read what it exposes before you connect it.
⚠️
Do not run an agent with unrestricted permissions on a machine that holds production credentials or unbacked-up work. Run it in a container, a virtual machine or a throwaway clone, keep secrets out of the workspace, and treat every command that leaves the sandbox as a human decision.
FAQ
Is it safe to run on my work laptop?
With the default mode, narrow permissions and a clean commit to fall back on, it is a reasonable risk for ordinary source work. It is not safe with
bypassPermissions on a machine holding production credentials or work you cannot restore from git.Can I stop it from reading a specific file?
Yes - add a
deny rule for that path in settings. Do it before the file matters, because a permission granted early in a session can already have been used, and transcripts persist.Related
A typical editing workflow Reviewing output and its limits
Last refreshed 2026-09-18.