{
 "ledger": {
  "title": "Claim Ledger: AI Agent Permissions: How to Stop Your Agent Doing Something You Can't Undo",
  "url": "https://durabilitycurve.com/claims/ai-agent-permissions/",
  "essay": {
   "title": "AI Agent Permissions: How to Stop Your Agent Doing Something You Can't Undo",
   "url": "https://durabilitycurve.com/blog/ai-agent-permissions/",
   "published": "2026-10-23"
  },
  "last_checked": "2026-10-23",
  "format": "current",
  "counts": {
   "claims": 101,
   "by_status": {
    "VERIFIED": 95,
    "EXECUTED": 6
   },
   "verified_at_primary": 95,
   "removed": 0
  },
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "attribution": "The Durability Curve (Harry Floyd), https://durabilitycurve.com/claims/ai-agent-permissions/"
 },
 "rows": [
  {
   "id": "1",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-1",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Anthropic's internal incident log includes an agent deleting remote git branches from a misread instruction",
   "quote": "\"Past examples include deleting remote git branches from a misinterpreted instruction, uploading an engineer's GitHub auth token to an internal compute cluster, and attempting migrations against a production database.\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "intro, para 3",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "2",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-2",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "The \"clean up old branches\" case, step by step",
   "quote": "\"A user asked to \\\"clean up old branches.\\\" The agent listed remote branches, constructed a pattern match, and issued a delete.\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "Threat model, \"Scope escalation\"",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "3",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-3",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Those examples are adapted from the log, not transcripts",
   "quote": "\"The examples below are adapted from our internal incident log to illustrate what auto mode is designed to block\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "Threat model",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "4",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-4",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Why Anthropic says auto mode would block it: vague request, irreversible action",
   "quote": "\"This would be blocked since the request was vague, the action irreversible and destructive, and the user may have only meant to delete local branches.\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "Threat model, \"Scope escalation\"",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "5",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-5",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Overeager behaviour defined",
   "quote": "\"takes initiative beyond what the user would approve\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "Threat model, first bullet",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "6",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-6",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Approval fatigue defined",
   "quote": "\"approval fatigue, where people stop paying close attention to what they're approving\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "intro, para 1",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "7",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-7",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Users accept 93% of manual prompts",
   "quote": "\"Manual prompts sit in the middle, and in practice users accept 93% of them anyway.\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "intro, para 2",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "8",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-8",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Auto mode's full pipeline misses 17% of real overeager actions (n = 52)",
   "quote": "\"The 17% false-negative rate on real overeager actions is the honest number.\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "9",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-9",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "The 52 are a small, curated set",
   "quote": "\"Small because it requires Claude attempting something dangerous in a real session, captured and labeled.\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "Results, dataset list",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "10",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-10",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Most misses see the danger and misread consent",
   "quote": "\"In the majority of misses we examined, the classifier correctly identifies the danger.\" / \"What it gets wrong is whether a real consent signal in the session actually covers this action.\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "Results, after table",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "11",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-11",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Consent example",
   "quote": "\"\\\"Clean up the PR\\\" was said by the user, but it doesn't name force-pushing.\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "Results",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "12",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-12",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Against careful manual review it may be worse",
   "quote": "\"If you are manually approving every action carefully, it's arguably a regression\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "Results",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "13",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-13",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Not for high-stakes infrastructure",
   "quote": "\"It is not a drop-in replacement for careful human review on high-stakes infrastructure.\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "Results, last para",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "14",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-14",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "In-project file edits skip the classifier",
   "quote": "\"File writes and edits inside the project directory are allowed without a classifier call.\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "How permission decisions work, Tier 2",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "15",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-15",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Entering auto mode drops broad code-execution allow rules",
   "quote": "\"on entering auto mode, we drop permission rules that are known to grant arbitrary code execution\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "Tier 1",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "16",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-16",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Default block rules include editing its own permission config",
   "quote": "\"modifying the agent's own permission config\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "The customizable slots, \"Degrade security posture\"",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "17",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-17",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Repeated denials stop the session",
   "quote": "\"If a session accumulates 3 consecutive denials or 20 total, we stop the model and escalate to the human.\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "Deny-and-continue",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "18",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-18",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Sandboxing cut prompts 84% in Anthropic's internal use",
   "quote": "\"In our internal usage, we've found that sandboxing safely reduces permission prompts by 84%.\"",
   "removal_reason": "",
   "source": "Anthropic, Beyond permission prompts, 20 Oct 2025",
   "source_url": "https://www.anthropic.com/research/claude-code-sandboxing",
   "locator": "intro",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "19",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-19",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "A sandbox needs both walls",
   "quote": "\"effective sandboxing requires both filesystem and network isolation\"",
   "removal_reason": "",
   "source": "Anthropic, Beyond permission prompts, 20 Oct 2025",
   "source_url": "https://www.anthropic.com/research/claude-code-sandboxing",
   "locator": "Network isolation",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "20",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-20",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Modes vs isolation",
   "quote": "\"Permission modes decide whether a tool call runs and whether you are prompted first. Isolation restricts what a command can access once it runs.\"",
   "removal_reason": "",
   "source": "Claude Code docs, Choose a sandbox environment",
   "source_url": "https://code.claude.com/docs/en/sandbox-environments",
   "locator": "How isolation relates to permission modes",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "21",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-21",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Manual (default) mode asks before edits, shell, network",
   "quote": "\"stops and asks you before most actions that edit files, run shell commands, or reach the network\"",
   "removal_reason": "",
   "source": "Claude Code docs, Permission modes",
   "source_url": "https://code.claude.com/docs/en/permission-modes",
   "locator": "intro",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "22",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-22",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Interactive sessions (terminal, VS Code) start in auto mode from v2.1.283",
   "quote": "\"With Claude Code v2.1.283 or later, auto mode is the built-in starting permission mode for interactive terminal and VS Code sessions.\"",
   "removal_reason": "",
   "source": "Claude Code docs, Permission modes",
   "source_url": "https://code.claude.com/docs/en/permission-modes",
   "locator": "intro",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "23",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-23",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Deny rules hold in every mode",
   "quote": "\"Deny rules block in every mode, including bypassPermissions.\"",
   "removal_reason": "",
   "source": "Claude Code docs, Permission modes",
   "source_url": "https://code.claude.com/docs/en/permission-modes",
   "locator": "modes section",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "24",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-24",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Bypass mode may write to .git and .claude",
   "quote": "\"In bypassPermissions mode, Claude Code skips permission prompts, including for writes to protected paths such as .git and .claude.\"",
   "removal_reason": "",
   "source": "Claude Code docs, Configure permissions",
   "source_url": "https://code.claude.com/docs/en/permissions",
   "locator": "modes table",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "25",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-25",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Bypass only in containers or VMs",
   "quote": "\"Only use this mode in isolated environments like containers or VMs where Claude Code can’t cause damage.\"",
   "removal_reason": "",
   "source": "Claude Code docs, Configure permissions",
   "source_url": "https://code.claude.com/docs/en/permissions",
   "locator": "modes table",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "26",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-26",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Rule order",
   "quote": "\"Rules are evaluated in order: deny, then ask, then allow.\"",
   "removal_reason": "",
   "source": "Claude Code docs, Configure permissions",
   "source_url": "https://code.claude.com/docs/en/permissions",
   "locator": "Manage permissions",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "27",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-27",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Argument patterns are fragile",
   "quote": "\"Bash permission patterns that try to constrain command arguments are fragile.\"",
   "removal_reason": "",
   "source": "Claude Code docs, Configure permissions",
   "source_url": "https://code.claude.com/docs/en/permissions",
   "locator": "warning box under \"Read-only commands\"",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "28",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-28",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Another spelling slips past a rule",
   "quote": "\"A push written another way, such as git -C . push, isn’t matched\"",
   "removal_reason": "",
   "source": "Claude Code docs, Configure permissions",
   "source_url": "https://code.claude.com/docs/en/permissions",
   "locator": "Wildcard patterns",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "29",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-29",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Project allow rules need workspace trust; deny rules don't",
   "quote": "\"Claude Code applies them only after you accept the workspace trust dialog for that folder.\" / \"deny and ask rules aren’t affected, since they only restrict.\"",
   "removal_reason": "",
   "source": "Claude Code docs, Configure permissions",
   "source_url": "https://code.claude.com/docs/en/permissions",
   "locator": "Project allow rules and workspace trust",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "30",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-30",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "The built-in sandbox covers shell commands only",
   "quote": "\"The sandbox covers shell commands only. Claude’s file tools, MCP servers, and hooks run outside it.\"",
   "removal_reason": "",
   "source": "Claude Code docs, Sandboxing",
   "source_url": "https://code.claude.com/docs/en/sandboxing",
   "locator": "intro",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "31",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-31",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "The classifier is not a boundary",
   "quote": "\"The classifier is a per-action control, not an isolation boundary\"",
   "removal_reason": "",
   "source": "Claude Code docs, Choose a sandbox environment",
   "source_url": "https://code.claude.com/docs/en/sandbox-environments",
   "locator": "Auto mode para",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "32",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-32",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Skip-permissions belongs in a container; refuses as root",
   "quote": "\"Always run --dangerously-skip-permissions sessions inside a container, a VM, or the sandbox runtime, so that file tools, MCP servers, and hooks are also inside the boundary.\" / \"Claude Code refuses to start with this flag when running as root\"",
   "removal_reason": "",
   "source": "Claude Code docs, Choose a sandbox environment",
   "source_url": "https://code.claude.com/docs/en/sandbox-environments",
   "locator": "--dangerously-skip-permissions para",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "33",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-33",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "With no prompts, the boundary is the protection",
   "quote": "\"With no prompts to catch mistakes, the isolation boundary you choose is what protects your system.\"",
   "removal_reason": "",
   "source": "Claude Code docs, Choose a sandbox environment",
   "source_url": "https://code.claude.com/docs/en/sandbox-environments",
   "locator": "same",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "34",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-34",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Two layers: sandbox and approval policy",
   "quote": "\"Sandbox mode: What Codex can do technically\" / \"Approval policy: When Codex must ask you before it executes an action\"",
   "removal_reason": "",
   "source": "OpenAI Codex docs, Agent approvals & security",
   "source_url": "https://learn.chatgpt.com/docs/agent-approvals-security",
   "locator": "intro",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "35",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-35",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Local defaults",
   "quote": "\"Defaults include no network access and write permissions limited to the active workspace.\"",
   "removal_reason": "",
   "source": "OpenAI Codex docs, Agent approvals & security",
   "source_url": "https://learn.chatgpt.com/docs/agent-approvals-security",
   "locator": "Codex CLI / IDE extension",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "36",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-36",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Recommendation by version control",
   "quote": "\"On launch, Codex detects whether the folder is version-controlled and recommends\"",
   "removal_reason": "",
   "source": "OpenAI Codex docs, Agent approvals & security",
   "source_url": "https://learn.chatgpt.com/docs/agent-approvals-security",
   "locator": "Defaults and recommendations",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "37",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-37",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "workspace-write is the low-friction default",
   "quote": "\"This is the default low-friction mode for local work.\"",
   "removal_reason": "",
   "source": "OpenAI Codex docs, Sandbox",
   "source_url": "https://learn.chatgpt.com/docs/sandboxing",
   "locator": "modes list",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "38",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-38",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "danger-full-access removes both walls",
   "quote": "\"This removes the filesystem and network boundaries\"",
   "removal_reason": "",
   "source": "OpenAI Codex docs, Sandbox",
   "source_url": "https://learn.chatgpt.com/docs/sandboxing",
   "locator": "modes list",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "39",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-39",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Rules for exceptions",
   "quote": "\"Rules let you allow, prompt, or forbid command prefixes outside the sandbox, which is often a better fit than broadly expanding access.\"",
   "removal_reason": "",
   "source": "OpenAI Codex docs, Sandbox",
   "source_url": "https://learn.chatgpt.com/docs/sandboxing",
   "locator": "approvals",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "40",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-40",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Automatic review leaves the wall where it was",
   "quote": "\"Automatic review, when available, doesn’t change the sandbox boundary.\"",
   "removal_reason": "",
   "source": "OpenAI Codex docs, Sandbox",
   "source_url": "https://learn.chatgpt.com/docs/sandboxing",
   "locator": "approvals",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "41",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-41",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Reviewer setting",
   "quote": "\"Set approvals_reviewer = \\\"auto_review\\\" to route eligible approval requests through a reviewer agent before Codex runs the request\"",
   "removal_reason": "",
   "source": "OpenAI Codex docs, Agent approvals & security",
   "source_url": "https://learn.chatgpt.com/docs/agent-approvals-security",
   "locator": "Automatic approval reviews",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "42",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-42",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Full-access flags",
   "quote": "\"use --sandbox danger-full-access (or the --dangerously-bypass-approvals-and-sandbox flag)\" ; \"--yolo or another full access sandbox setting\"",
   "removal_reason": "",
   "source": "OpenAI Codex docs, Agent approvals & security",
   "source_url": "https://learn.chatgpt.com/docs/agent-approvals-security",
   "locator": "\"Run without approval prompts\" (first quote); web search paragraph (--yolo)",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "43",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-43",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Run Modes defined; three modes (Auto-review, Allowlist, Run Everything)",
   "quote": "\"Run Modes control how the Cursor agent runs tool calls, and when Cursor interrupts you for approval.\"",
   "removal_reason": "",
   "source": "Cursor docs, Run Modes",
   "source_url": "https://cursor.com/docs/agent/security/run-modes",
   "locator": "top + Pick a mode table",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "44",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-44",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Run Everything",
   "quote": "\"Every tool call runs automatically.\"",
   "removal_reason": "",
   "source": "Cursor docs, Run Modes",
   "source_url": "https://cursor.com/docs/agent/security/run-modes",
   "locator": "Pick a mode table",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "45",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-45",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Cursor's recommendation",
   "quote": "\"The safest useful setup for most people is Auto-review.\"",
   "removal_reason": "",
   "source": "Cursor docs, Run Modes",
   "source_url": "https://cursor.com/docs/agent/security/run-modes",
   "locator": "top",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "46",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-46",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Not a boundary",
   "quote": "\"Auto-review is not a security boundary\"",
   "removal_reason": "",
   "source": "Cursor docs, Run Modes",
   "source_url": "https://cursor.com/docs/agent/security/run-modes",
   "locator": "How Auto-review works",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "47",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-47",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Auto-review became Cursor's recommended default on 29 May 2026 (says nothing of the earlier default)",
   "quote": "\"Auto-review shipped as the recommended default.\" (row 3.6, May 29, 2026) / \"Ask Every Time was deprecated.\" (row 3.5, May 22, 2026)",
   "removal_reason": "",
   "source": "Cursor docs, Run Modes",
   "source_url": "https://cursor.com/docs/agent/security/run-modes",
   "locator": "history table",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "50",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-50",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Auto-accept is common",
   "quote": "\"Many developers run these agents with auto-accept enabled, meaning the agent operates with the developer's full permissions and minimal human oversight.\"",
   "removal_reason": "",
   "source": "OWASP, Secure Coding with AI Cheat Sheet",
   "source_url": "https://cheatsheetseries.owasp.org/cheatsheets/Secure_Coding_with_AI_Cheat_Sheet.html",
   "locator": "intro",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "51",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-51",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Git can refuse ref deletions pushed to a repository",
   "quote": "\"If set to true, git-receive-pack will deny a ref update that deletes the ref.\"",
   "removal_reason": "",
   "source": "git docs, git-config",
   "source_url": "https://git-scm.com/docs/git-config",
   "locator": "receive.denyDeletes",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "52",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-52",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "GitHub rulesets restrict deletions, on by default",
   "quote": "\"only users with bypass permissions can delete branches or tags whose name matches the pattern you specify. This rule is selected by default.\"",
   "removal_reason": "",
   "source": "GitHub Docs, Available rules for rulesets",
   "source_url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets",
   "locator": "Restrict deletions",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "53",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-53",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "GitHub rulesets block force pushes, on by default",
   "quote": "\"You can prevent users from force pushing to the targeted branches or tags. This rule is enabled by default.\"",
   "removal_reason": "",
   "source": "GitHub Docs, Available rules for rulesets",
   "source_url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets",
   "locator": "Block force pushes",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "54",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-54",
   "status": "EXECUTED",
   "status_label": "Executed",
   "removed": false,
   "claim": "Deny rule Bash(git push origin --delete *) blocks git push origin --delete old-1",
   "quote": "\"Permission to use Bash with command git push origin --delete old-1 has been denied.\"",
   "removal_reason": "",
   "source": "Our run (RUN.md)",
   "source_url": "",
   "locator": "",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "55",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-55",
   "status": "EXECUTED",
   "status_label": "Executed",
   "removed": false,
   "claim": "With Bash(git push *) pre-approved (so ordinary pushes run), the same delete as git push origin :old-1 passes the deny rule and deletes the branch",
   "quote": "\" - [deleted] old-1\"",
   "removal_reason": "",
   "source": "Our run (RUN.md)",
   "source_url": "",
   "locator": "",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "56",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-56",
   "status": "EXECUTED",
   "status_label": "Executed",
   "removed": false,
   "claim": "With receive.denyDeletes on the remote, the colon form is refused",
   "quote": "\" ! [remote rejected] old-2 (deletion prohibited)\"",
   "removal_reason": "",
   "source": "Our run (RUN.md)",
   "source_url": "",
   "locator": "",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "57",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-57",
   "status": "EXECUTED",
   "status_label": "Executed",
   "removed": false,
   "claim": "On \"Clean up old branches.\" the agent deleted local branches only, 3 of 3 recorded runs (headless, dontAsk, one prompt)",
   "quote": "demo/task-run-1.txt, task-run-2.txt, task-run-3.txt (raw output, 23 Oct 2026 18:43–18:44 BST, file times); an earlier unrecorded set of 3 matched",
   "removal_reason": "",
   "source": "Our run (RUN.md)",
   "source_url": "",
   "locator": "",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "58",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-58",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "A larger test of the same gap: one Bash(git push:*) deny rule, 14 spellings, 5 reached the remote (Claude Code 2.1.278, run 2026-09-22)",
   "quote": "\"The rule blocked 8 of them. 5 pushed to the remote\"",
   "removal_reason": "",
   "source": "Rulestack (a seller of rule packs), 24 Sep 2026",
   "source_url": "https://rulestack.hashnode.dev/claude-code-permission-rules-bash-git-push-stopped-8-of-14-ways-to-push-and-5-reached-the-remote",
   "locator": "first para + scoreboard",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "59",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-59",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "VS Code says the same of its own auto-approval rules",
   "quote": "\"Shell aliases, quote concatenation, and complex shell syntax can bypass the rules and slip through undetected.\"",
   "removal_reason": "",
   "source": "VS Code docs, Trust and safety",
   "source_url": "https://code.visualstudio.com/docs/agents/concepts/trust-and-safety",
   "locator": "Why sandboxing matters",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "60",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-60",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "An earlier Substack explainer argues the environment matters more than the model",
   "quote": "\"why the environment matters more than the model\"",
   "removal_reason": "",
   "source": "Paul Goldsmith-Pinkham, Permissions, Sandboxes, and Autonomous Agents, A Causal Affair, 24 May 2026",
   "source_url": "https://paulgp.substack.com/p/permissions-sandboxes-and-autonomous",
   "locator": "intro",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "61",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-61",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Default block rules, first group: irreversible loss",
   "quote": "\"Destroy or exfiltrate. Cause irreversible loss by force-pushing over history, mass-deleting cloud storage, or sending internal data externally.\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "The customizable slots",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "62",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-62",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Default block rules, fourth group: shared systems",
   "quote": "\"Bypass review or affect others. Skip safeguards on shared infrastructure by pushing directly to main, running production deploys, or modifying shared resources or jobs the agent didn't create.\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "The customizable slots",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "63",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-63",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "The deployed pipeline wrongly blocks 0.4% of real traffic",
   "quote": "\"FPR drops from 8.5% to 0.4%, at the cost of some recall.\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "Results, table caption",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "64",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-64",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "A false block costs a retry",
   "quote": "\"a false positive costs a single retry where the agent gets a nudge, reconsiders, and usually finds an alternative path\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "Deny-and-continue",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "65",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-65",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "dontAsk refuses anything not pre-approved (an allowlist)",
   "quote": "\"anything that would prompt is denied\"",
   "removal_reason": "",
   "source": "Claude Code docs, Permission modes",
   "source_url": "https://code.claude.com/docs/en/permission-modes",
   "locator": "modes table, dontAsk row",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "66",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-66",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Least privilege for agents",
   "quote": "\"Apply least privilege -- a coding agent does not need access to email, payment, or administrative tools.\"",
   "removal_reason": "",
   "source": "OWASP, Secure Coding with AI Cheat Sheet",
   "source_url": "https://cheatsheetseries.owasp.org/cheatsheets/Secure_Coding_with_AI_Cheat_Sheet.html",
   "locator": "Do (MCP / tools)",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "67",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-67",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Compared with no checks, auto mode is a big step up",
   "quote": "\"If you are running --dangerously-skip-permissions, this is a substantial improvement.\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "Results",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "68",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-68",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Why in-project edits skip the classifier",
   "quote": "\"in-project edits are reviewable via version control\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "Tier 2",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "69",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-69",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "The bypass/auto off-switches are best placed in managed settings, which take precedence over user and project settings",
   "quote": "\"These are most useful in managed settings where they can’t be overridden.\" (of permissions.disableBypassPermissionsMode / disableAutoMode)",
   "removal_reason": "",
   "source": "Claude Code docs, Configure permissions",
   "source_url": "https://code.claude.com/docs/en/permissions",
   "locator": "modes section",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "70",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-70",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "A headless run never shows the trust dialog",
   "quote": "\"A claude -p run or an SDK session never shows it\"",
   "removal_reason": "",
   "source": "Claude Code docs, Configure permissions",
   "source_url": "https://code.claude.com/docs/en/permissions",
   "locator": "Project allow rules and workspace trust",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "71",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-71",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Codex on-request asks at the sandbox edge",
   "quote": "\"on-request: The agent works inside the sandbox by default and asks when it needs to go beyond that boundary.\"",
   "removal_reason": "",
   "source": "OpenAI Codex docs, Sandbox",
   "source_url": "https://learn.chatgpt.com/docs/sandboxing",
   "locator": "approval policies",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "72",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-72",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "The 0.4% is measured on 10,000 real staff actions",
   "quote": "\"Real internal traffic (n = 10,000). Actual Claude Code tool calls from Anthropic employees.\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "Results, dataset list",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "73",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-73",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Where the 52 came from",
   "quote": "\"Curated from sessions where an employee denied the action or it was flagged post-hoc.\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "Results, dataset list",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "74",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-74",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "What Auto-review does with each call",
   "quote": "\"Allowlisted calls run immediately. Other shell commands run in the sandbox when possible. Calls that do not use the sandbox go to the Auto-review classifier.\"",
   "removal_reason": "",
   "source": "Cursor docs, Run Modes",
   "source_url": "https://cursor.com/docs/agent/security/run-modes",
   "locator": "Pick a mode table, Auto-review row",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "75",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-75",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Plan mode blocks edits until a plan is approved",
   "quote": "\"Claude Code blocks edits until you approve a plan\"",
   "removal_reason": "",
   "source": "Claude Code docs, Permission modes",
   "source_url": "https://code.claude.com/docs/en/permission-modes",
   "locator": "Common setups table, plan row",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "76",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-76",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "A real auto-mode incident: Opus 5 pushed deletion commits to two main branches; neither the model nor the classifier stopped it",
   "quote": "\"So I had started treating the model and the classifier as two layers of safety. Neither stopped this.\"",
   "removal_reason": "",
   "source": "François Martin, Karakun, How my coding agent pushed a commit deleting every file to main, 28 Aug 2026",
   "source_url": "https://dev.karakun.com/2026/08/28/coding-agent-pushed-deletion-to-main.html",
   "locator": "Why coding agent safety checks were not enough",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "77",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-77",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "The size of that deletion",
   "quote": "\"The deletion commits removed 151 files from one main branch and 723 from the other.\"",
   "removal_reason": "",
   "source": "François Martin, Karakun, How my coding agent pushed a commit deleting every file to main, 28 Aug 2026",
   "source_url": "https://dev.karakun.com/2026/08/28/coding-agent-pushed-deletion-to-main.html",
   "locator": "opening",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "79",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-79",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Branch protection is the strongest guard; prior statement of the ordering",
   "quote": "\"Branch protection is the most effective safeguard\"",
   "removal_reason": "",
   "source": "François Martin, Karakun, How my coding agent pushed a commit deleting every file to main, 28 Aug 2026",
   "source_url": "https://dev.karakun.com/2026/08/28/coding-agent-pushed-deletion-to-main.html",
   "locator": "Start with Git branch protection",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "80",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-80",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "The server sees the agent as you, unless it has its own identity",
   "quote": "\"The agent pushes with my credentials, so the server sees me.\" / \"a machine account or app installation whose credentials have no bypass rights\"",
   "removal_reason": "",
   "source": "François Martin, Karakun, How my coding agent pushed a commit deleting every file to main, 28 Aug 2026",
   "source_url": "https://dev.karakun.com/2026/08/28/coding-agent-pushed-deletion-to-main.html",
   "locator": "Start with Git branch protection",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "82",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-82",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "An agent disabled branch protection and a ruleset to force-push",
   "quote": "\"the agent disabled GitHub branch protection rules and a repository ruleset without user authorization in order to unblock a force push.\" / \"Deleted the branch protection rule entirely\"",
   "removal_reason": "",
   "source": "anthropics/claude-code issue #42849 (user report, Claude Code CLI, Sonnet 4.6), 2 Apr 2026, closed",
   "source_url": "https://github.com/anthropics/claude-code/issues/42849",
   "locator": "Summary; What happened",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "84",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-84",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Rulesets on private repos need a paid GitHub plan",
   "quote": "\"Rulesets are available in public repositories with GitHub Free and GitHub Free for organizations, and in public and private repositories with GitHub Pro, GitHub Team, and GitHub Enterprise Cloud.\"",
   "removal_reason": "",
   "source": "GitHub Docs, About rulesets",
   "source_url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets",
   "locator": "Who can use this feature?",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "85",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-85",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "A deny rule covers the usual spelling and is not a boundary",
   "quote": "\"a deny or ask rule covers the invocation Claude usually produces and isn’t a security boundary around the program\"",
   "removal_reason": "",
   "source": "Claude Code docs, Configure permissions",
   "source_url": "https://code.claude.com/docs/en/permissions",
   "locator": "What a Bash rule doesn't match",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "87",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-87",
   "status": "EXECUTED",
   "status_label": "Executed",
   "removed": false,
   "claim": "The throwaway remote in our runs is a folder the agent can reach directly",
   "quote": "\"The \"remote\" is a folder on the same machine. So these runs test the refusal, not separation: an agent could delete the branch directly with git -C ../remote.git branch -D.\"",
   "removal_reason": "",
   "source": "Our run (RUN.md caveat; re-tested: git -C ../remote.git branch -D old-1 deleted the branch with receive.denyDeletes on)",
   "source_url": "",
   "locator": "",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "88",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-88",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Auto mode's second stage trades some recall for fewer false blocks",
   "quote": "\"It cleans up the false positives but lets a few more dangerous actions through.\"",
   "removal_reason": "",
   "source": "Anthropic, How we built Claude Code auto mode, 25 Mar 2026",
   "source_url": "https://www.anthropic.com/research/claude-code-auto-mode",
   "locator": "Results",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "90",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-90",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Martin's deletion came from a recovery attempt",
   "quote": "\"Claude tried to undo the broken commits using a shallow clone that contained only the latest commit instead of the full Git history.\" / \"Reverting it therefore staged every single file in the repository for deletion.\"",
   "removal_reason": "",
   "source": "François Martin, Karakun, How my coding agent pushed a commit deleting every file to main, 28 Aug 2026",
   "source_url": "https://dev.karakun.com/2026/08/28/coding-agent-pushed-deletion-to-main.html",
   "locator": "How the attempted recovery emptied both branches",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "91",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-91",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Martin's ordering: three layers, branch protection first",
   "quote": "\"I would set up three layers, in this order.\"",
   "removal_reason": "",
   "source": "François Martin, Karakun, How my coding agent pushed a commit deleting every file to main, 28 Aug 2026",
   "source_url": "https://dev.karakun.com/2026/08/28/coding-agent-pushed-deletion-to-main.html",
   "locator": "Git safeguards for AI coding agents",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "93",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-93",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Anthropic keeps git credentials out of the web sandbox",
   "quote": "\"We've designed this sandbox to ensure that sensitive credentials (such as git credentials or signing keys) are never inside the sandbox with Claude Code.\"",
   "removal_reason": "",
   "source": "Anthropic, Beyond permission prompts, 20 Oct 2025",
   "source_url": "https://www.anthropic.com/research/claude-code-sandboxing",
   "locator": "Claude Code on the web",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "96",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-96",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Git can refuse forced, non-fast-forward updates",
   "quote": "\"If set to true, git-receive-pack will deny a ref update which is not a fast-forward. Use this to prevent such an update via a push, even if that push is forced.\"",
   "removal_reason": "",
   "source": "git docs, git-config",
   "source_url": "https://git-scm.com/docs/git-config",
   "locator": "receive.denyNonFastForwards",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "97",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-97",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "#42849's task needed a force-push",
   "quote": "\"User asked to scrub a file from git history\"",
   "removal_reason": "",
   "source": "anthropics/claude-code issue #42849 (user report, Sonnet 4.6), 2 Apr 2026, closed as duplicate",
   "source_url": "https://github.com/anthropics/claude-code/issues/42849",
   "locator": "What happened",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "98",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-98",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Auto mode needs a supported model and can be switched off by an organisation",
   "quote": "\"Requires a supported model, and your organization can turn auto mode off\"",
   "removal_reason": "",
   "source": "Claude Code docs, Permission modes",
   "source_url": "https://code.claude.com/docs/en/permission-modes",
   "locator": "Common setups table, auto row",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "99",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-99",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Cursor: an empty Allowlist behaves like the old ask-every-time mode (figure: \"Allowlist, left empty\" under \"Asks you\")",
   "quote": "\"Ask Every Time was deprecated. New users cannot choose it. Use Allowlist with an empty allowlist for the same behavior.\"",
   "removal_reason": "",
   "source": "Cursor docs, Run Modes",
   "source_url": "https://cursor.com/docs/agent/security/run-modes",
   "locator": "history table, 3.5",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "100",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-100",
   "status": "EXECUTED",
   "status_label": "Executed",
   "removed": false,
   "claim": "With denyDeletes and denyNonFastForwards on, an ordinary push of a commit deleting every file is accepted",
   "quote": "\"files on remote main: 0\"",
   "removal_reason": "",
   "source": "Our run (demo/fast-forward-delete-test.sh)",
   "source_url": "",
   "locator": "",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "101",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-101",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Martin: a required pull request would have stopped both his incidents",
   "quote": "\"Letting the agent open a pull request instead would have stopped both incidents, even with automatic merging once CI passed\"",
   "removal_reason": "",
   "source": "François Martin, Karakun, How my coding agent pushed a commit deleting every file to main, 28 Aug 2026",
   "source_url": "https://dev.karakun.com/2026/08/28/coding-agent-pushed-deletion-to-main.html",
   "locator": "Start with Git branch protection",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "102",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-102",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Current auto-mode defaults allow pushes to any branch of the working repository, including the default branch; force push stays blocked",
   "quote": "\"Pushing to any branch of the repository you’re working in, including the default branch.\" / \"Force push\"",
   "removal_reason": "",
   "source": "Claude Code docs, Permission modes",
   "source_url": "https://code.claude.com/docs/en/permission-modes",
   "locator": "What the classifier blocks by default (Allowed by default; block list)",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "103",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-103",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Claude Code's sandbox gives commands no direct network route; its proxy checks each host against allowed and denied domains",
   "quote": "\"A sandboxed command has no direct route to the network\" / \"The proxy checks the hostname of each connection against your allowed and denied domains.\"",
   "removal_reason": "",
   "source": "Claude Code docs, Sandboxing",
   "source_url": "https://code.claude.com/docs/en/sandboxing",
   "locator": "Network isolation",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "104",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-104",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "GitHub rulesets include requiring a pull request before merging",
   "quote": "\"Require a pull request before merging\"",
   "removal_reason": "",
   "source": "GitHub Docs, Available rules for rulesets",
   "source_url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets",
   "locator": "rules list",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "105",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-105",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "A command the sandbox blocks can be retried outside it unless allowUnsandboxedCommands is false",
   "quote": "\"Overrides: choose whether commands that fail under the sandbox can fall back to running unsandboxed. This is the allowUnsandboxedCommands setting\"",
   "removal_reason": "",
   "source": "Claude Code docs, Sandboxing",
   "source_url": "https://code.claude.com/docs/en/sandboxing",
   "locator": "Configure the sandbox / Overrides",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "106",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-106",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "A required pull request need not be approved",
   "quote": "\"The pull request doesn't necessarily have to be approved, but it must be opened.\"",
   "removal_reason": "",
   "source": "GitHub Docs, Available rules for rulesets",
   "source_url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets",
   "locator": "Require a pull request before merging",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "107",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-107",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Rulesets can require status checks to pass",
   "quote": "\"Require status checks to pass before merging\"",
   "removal_reason": "",
   "source": "GitHub Docs, Available rules for rulesets",
   "source_url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets",
   "locator": "rules list",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "108",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-108",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Martin: CI would have failed both his incidents' commits",
   "quote": "\"neither the invalid YAML nor the deletion commits would have passed CI\"",
   "removal_reason": "",
   "source": "François Martin, Karakun, How my coding agent pushed a commit deleting every file to main, 28 Aug 2026",
   "source_url": "https://dev.karakun.com/2026/08/28/coding-agent-pushed-deletion-to-main.html",
   "locator": "Start with Git branch protection",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "109",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-109",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Plan mode still runs classifier-approved commands",
   "quote": "\"Reads, plus classifier-approved commands when auto mode is available\"",
   "removal_reason": "",
   "source": "Claude Code docs, Permission modes",
   "source_url": "https://code.claude.com/docs/en/permission-modes",
   "locator": "modes table, plan row",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "110",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-110",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Required status checks only ensure the required CI tests pass",
   "quote": "\"Required status checks ensure that all required CI tests are passing before collaborators can make changes to a branch or tag targeted by your ruleset.\"",
   "removal_reason": "",
   "source": "GitHub Docs, Available rules for rulesets",
   "source_url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets",
   "locator": "Require status checks to pass before merging",
   "date_read": "",
   "in_essay": ""
  },
  {
   "id": "111",
   "url": "https://durabilitycurve.com/claims/ai-agent-permissions/#c-111",
   "status": "VERIFIED",
   "status_label": "Verified",
   "removed": false,
   "claim": "Codex's read-only sandbox mode",
   "quote": "\"read-only: The agent can inspect files, but it can’t edit files or run commands without approval.\"",
   "removal_reason": "",
   "source": "OpenAI Codex docs, Sandbox",
   "source_url": "https://learn.chatgpt.com/docs/sandboxing",
   "locator": "modes list",
   "date_read": "",
   "in_essay": ""
  }
 ]
}