---
title: "Claim Ledger: AI Agent Permissions: How to Stop Your Agent Doing Something You Can't Undo"
description: "Our deny rule stopped one spelling of a branch delete and missed the next. The guards that hold for agent actions you can't undo, and how to test yours."
author: "Harry Floyd"
publication: "The Durability Curve"
canonical: "https://durabilitycurve.com/claims/ai-agent-permissions/"
essay: "https://durabilitycurve.com/blog/ai-agent-permissions/"
published: "2026-10-23"
ledger_date: "2026-10-23"
claims: 101
removed_before_publication: 0
---

# Claim Ledger: AI Agent Permissions: How to Stop Your Agent Doing Something You Can't Undo

*Our deny rule stopped one spelling of a branch delete and missed the next. The guards that hold for agent actions you can't undo, and how to test yours.*

Essay: https://durabilitycurve.com/blog/ai-agent-permissions/  
Ledger (canonical, cite this): https://durabilitycurve.com/claims/ai-agent-permissions/  
Published 2026-10-23 · last verified 2026-10-23

## What the essay claims

Before: "my agent asks before anything dangerous, so I'm covered", or "auto mode is the safe setting". After: asking checks consent, and consent is the judgement both people and classifiers get wrong. People accept 93% of prompts. Anthropic's classifier misses 17% of real overeager actions, and when it misses it has usually seen the danger and misread the consent. A rule doesn't read consent, but it matches spellings, so it misses the same action written another way. A sandbox limits reach, but not inside what it allows. The guard that doesn't care about consent, spelling or reach is a refusal where the action lands. So the order is: work out which actions can't be undone, and put each one behind the strongest guard that doesn't depend on someone's reading of the moment.

## The claim ladder

What the ladder does not reach: - No row compares guards head to head on a common task set. - The 93% and 17% figures are Anthropic's measurements of its own users and its own classifier. - Our run tests one deny rule, two spellings and one git setting on one machine. - Nothing here shows the destination-side guard cannot itself be misconfigured.

| # | Claim | Whose behaviour it measures | Status / scope |
|---|---|---|---|
| 1 | An agent asked to "clean up old branches" listed remote branches and deleted them | Anthropic's internal incident log, adapted in their post | One vendor's log; adapted, not a transcript |
| 2 | Users accept 93% of manual prompts | Anthropic's users of Claude Code | Vendor's own usage data; no method given |
| 3 | Auto mode's full pipeline misses 17% of real overeager actions; most misses see the danger and misread consent | Anthropic's classifier on 52 curated actions | Small set (n = 52), vendor-run |
| 4 | Sandboxing cut permission prompts 84% | Anthropic's internal use | Vendor internal figure |
| 5 | A sandbox needs file and network walls; Claude Code's covers shell commands only | Anthropic engineering post; Claude Code docs | Vendor documentation |
| 6 | Deny rules hold in every mode, including bypass; argument patterns are fragile | Claude Code docs | Vendor documentation |
| 7 | A deny rule stopped git push origin --delete old-1, missed git push origin :old-1, and receive.denyDeletes refused the second | Our run, Claude Code 2.1.292, Opus 5.5, one local repo | First-party, one run per command; not a survey of spellings |
| 8 | One deny rule stopped 8 of 14 spellings of a push; 5 reached the remote | Rulestack's run on Claude Code 2.1.278 | Third-party, single run each; a rule-pack seller |
| 9 | Codex separates the sandbox from the approval policy, defaults to no network and workspace-only writes; automatic review doesn't move the wall | OpenAI Codex docs | Vendor documentation |
| 10 | Cursor recommends Auto-review and says it is not a security boundary | Cursor docs | Vendor documentation |
| 11 | GitHub rulesets restrict deletions and block force pushes by default | GitHub docs | Read, not exercised |
| 12 | Bypass mode can write to .claude and .git; run it only in a container or VM; it refuses to start as root | Claude Code docs | Vendor documentation |
| 13 | On the incident's own words, Opus 5.5 deleted only local branches, 3 of 3 runs | Our run | n = 3, one phrasing; says nothing about other prompts |

The guide reports, demonstrates once, and recommends. It does not survey.

## What would make it wrong

The guide is wrong if, for actions that can't be undone, an approval step (a person or a classifier) stops them about as reliably as a refusal at the destination. Two things would show it: - Auto mode's miss rate on real overeager actions falls to near zero, with the consent misreads gone. - Deny rules start matching the action rather than its spelling, so a second spelling no longer gets through.

Either would move that guard up the ladder, and the ordering would need re-testing.

## The evidence, row by row

Labels: VERIFIED = checked against the primary source itself by a checker who did not draft the piece, usually with the exact words, where they sit and the date read · EXECUTED = a run or observation done for the piece (code, a query, a count, or a check made live in an app); the claim is what it returned; run records are not published · CHECKED = checked against its source by a separate checker in the older ledger format, which recorded no quote, locator or date · REPORTED = not verified word for word against a primary source (secondary, not openable in full, or supported only in part); the essay words it accordingly · STRUCK = drafted, checked and removed before publication · EXCLUDED = considered and deliberately left out.

### 1. Anthropic's internal incident log includes an agent deleting remote git branches from a misread instruction

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-1
- Quote: "Past examples include deleting remote git branches from a misinterpreted instruction, uploading an engineer's GitHub auth token to an internal compute cluster, and attempting migrations against a production database."
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, intro, para 3
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 2. The "clean up old branches" case, step by step

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-2
- Quote: "A user asked to \"clean up old branches.\" The agent listed remote branches, constructed a pattern match, and issued a delete."
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, Threat model, "Scope escalation"
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 3. Those examples are adapted from the log, not transcripts

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-3
- Quote: "The examples below are adapted from our internal incident log to illustrate what auto mode is designed to block"
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, Threat model
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 4. Why Anthropic says auto mode would block it: vague request, irreversible action

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-4
- Quote: "This would be blocked since the request was vague, the action irreversible and destructive, and the user may have only meant to delete local branches."
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, Threat model, "Scope escalation"
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 5. Overeager behaviour defined

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-5
- Quote: "takes initiative beyond what the user would approve"
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, Threat model, first bullet
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 6. Approval fatigue defined

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-6
- Quote: "approval fatigue, where people stop paying close attention to what they're approving"
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, intro, para 1
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 7. Users accept 93% of manual prompts

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-7
- Quote: "Manual prompts sit in the middle, and in practice users accept 93% of them anyway."
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, intro, para 2
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 8. Auto mode's full pipeline misses 17% of real overeager actions (n = 52)

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-8
- Quote: "The 17% false-negative rate on real overeager actions is the honest number."
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 9. The 52 are a small, curated set

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-9
- Quote: "Small because it requires Claude attempting something dangerous in a real session, captured and labeled."
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, Results, dataset list
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 10. Most misses see the danger and misread consent

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-10
- Quote: "In the majority of misses we examined, the classifier correctly identifies the danger." / "What it gets wrong is whether a real consent signal in the session actually covers this action."
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, Results, after table
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 11. Consent example

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-11
- Quote: "\"Clean up the PR\" was said by the user, but it doesn't name force-pushing."
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, Results
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 12. Against careful manual review it may be worse

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-12
- Quote: "If you are manually approving every action carefully, it's arguably a regression"
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, Results
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 13. Not for high-stakes infrastructure

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-13
- Quote: "It is not a drop-in replacement for careful human review on high-stakes infrastructure."
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, Results, last para
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 14. In-project file edits skip the classifier

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-14
- Quote: "File writes and edits inside the project directory are allowed without a classifier call."
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, How permission decisions work, Tier 2
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 15. Entering auto mode drops broad code-execution allow rules

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-15
- Quote: "on entering auto mode, we drop permission rules that are known to grant arbitrary code execution"
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, Tier 1
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 16. Default block rules include editing its own permission config

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-16
- Quote: "modifying the agent's own permission config"
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, The customizable slots, "Degrade security posture"
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 17. Repeated denials stop the session

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-17
- Quote: "If a session accumulates 3 consecutive denials or 20 total, we stop the model and escalate to the human."
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, Deny-and-continue
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 18. Sandboxing cut prompts 84% in Anthropic's internal use

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-18
- Quote: "In our internal usage, we've found that sandboxing safely reduces permission prompts by 84%."
- Source: Anthropic, Beyond permission prompts, 20 Oct 2025, intro
- URL: https://www.anthropic.com/research/claude-code-sandboxing

### 19. A sandbox needs both walls

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-19
- Quote: "effective sandboxing requires both filesystem and network isolation"
- Source: Anthropic, Beyond permission prompts, 20 Oct 2025, Network isolation
- URL: https://www.anthropic.com/research/claude-code-sandboxing

### 20. Modes vs isolation

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-20
- Quote: "Permission modes decide whether a tool call runs and whether you are prompted first. Isolation restricts what a command can access once it runs."
- Source: Claude Code docs, Choose a sandbox environment, How isolation relates to permission modes
- URL: https://code.claude.com/docs/en/sandbox-environments

### 21. Manual (default) mode asks before edits, shell, network

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-21
- Quote: "stops and asks you before most actions that edit files, run shell commands, or reach the network"
- Source: Claude Code docs, Permission modes, intro
- URL: https://code.claude.com/docs/en/permission-modes

### 22. Interactive sessions (terminal, VS Code) start in auto mode from v2.1.283

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-22
- Quote: "With Claude Code v2.1.283 or later, auto mode is the built-in starting permission mode for interactive terminal and VS Code sessions."
- Source: Claude Code docs, Permission modes, intro
- URL: https://code.claude.com/docs/en/permission-modes

### 23. Deny rules hold in every mode

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-23
- Quote: "Deny rules block in every mode, including bypassPermissions."
- Source: Claude Code docs, Permission modes, modes section
- URL: https://code.claude.com/docs/en/permission-modes

### 24. Bypass mode may write to .git and .claude

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-24
- Quote: "In bypassPermissions mode, Claude Code skips permission prompts, including for writes to protected paths such as .git and .claude."
- Source: Claude Code docs, Configure permissions, modes table
- URL: https://code.claude.com/docs/en/permissions

### 25. Bypass only in containers or VMs

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-25
- Quote: "Only use this mode in isolated environments like containers or VMs where Claude Code can’t cause damage."
- Source: Claude Code docs, Configure permissions, modes table
- URL: https://code.claude.com/docs/en/permissions

### 26. Rule order

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-26
- Quote: "Rules are evaluated in order: deny, then ask, then allow."
- Source: Claude Code docs, Configure permissions, Manage permissions
- URL: https://code.claude.com/docs/en/permissions

### 27. Argument patterns are fragile

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-27
- Quote: "Bash permission patterns that try to constrain command arguments are fragile."
- Source: Claude Code docs, Configure permissions, warning box under "Read-only commands"
- URL: https://code.claude.com/docs/en/permissions

### 28. Another spelling slips past a rule

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-28
- Quote: "A push written another way, such as git -C . push, isn’t matched"
- Source: Claude Code docs, Configure permissions, Wildcard patterns
- URL: https://code.claude.com/docs/en/permissions

### 29. Project allow rules need workspace trust; deny rules don't

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-29
- Quote: "Claude Code applies them only after you accept the workspace trust dialog for that folder." / "deny and ask rules aren’t affected, since they only restrict."
- Source: Claude Code docs, Configure permissions, Project allow rules and workspace trust
- URL: https://code.claude.com/docs/en/permissions

### 30. The built-in sandbox covers shell commands only

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-30
- Quote: "The sandbox covers shell commands only. Claude’s file tools, MCP servers, and hooks run outside it."
- Source: Claude Code docs, Sandboxing, intro
- URL: https://code.claude.com/docs/en/sandboxing

### 31. The classifier is not a boundary

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-31
- Quote: "The classifier is a per-action control, not an isolation boundary"
- Source: Claude Code docs, Choose a sandbox environment, Auto mode para
- URL: https://code.claude.com/docs/en/sandbox-environments

### 32. Skip-permissions belongs in a container; refuses as root

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-32
- Quote: "Always run --dangerously-skip-permissions sessions inside a container, a VM, or the sandbox runtime, so that file tools, MCP servers, and hooks are also inside the boundary." / "Claude Code refuses to start with this flag when running as root"
- Source: Claude Code docs, Choose a sandbox environment, --dangerously-skip-permissions para
- URL: https://code.claude.com/docs/en/sandbox-environments

### 33. With no prompts, the boundary is the protection

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-33
- Quote: "With no prompts to catch mistakes, the isolation boundary you choose is what protects your system."
- Source: Claude Code docs, Choose a sandbox environment, same
- URL: https://code.claude.com/docs/en/sandbox-environments

### 34. Two layers: sandbox and approval policy

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-34
- Quote: "Sandbox mode: What Codex can do technically" / "Approval policy: When Codex must ask you before it executes an action"
- Source: OpenAI Codex docs, Agent approvals & security, intro
- URL: https://learn.chatgpt.com/docs/agent-approvals-security

### 35. Local defaults

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-35
- Quote: "Defaults include no network access and write permissions limited to the active workspace."
- Source: OpenAI Codex docs, Agent approvals & security, Codex CLI / IDE extension
- URL: https://learn.chatgpt.com/docs/agent-approvals-security

### 36. Recommendation by version control

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-36
- Quote: "On launch, Codex detects whether the folder is version-controlled and recommends"
- Source: OpenAI Codex docs, Agent approvals & security, Defaults and recommendations
- URL: https://learn.chatgpt.com/docs/agent-approvals-security

### 37. workspace-write is the low-friction default

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-37
- Quote: "This is the default low-friction mode for local work."
- Source: OpenAI Codex docs, Sandbox, modes list
- URL: https://learn.chatgpt.com/docs/sandboxing

### 38. danger-full-access removes both walls

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-38
- Quote: "This removes the filesystem and network boundaries"
- Source: OpenAI Codex docs, Sandbox, modes list
- URL: https://learn.chatgpt.com/docs/sandboxing

### 39. Rules for exceptions

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-39
- Quote: "Rules let you allow, prompt, or forbid command prefixes outside the sandbox, which is often a better fit than broadly expanding access."
- Source: OpenAI Codex docs, Sandbox, approvals
- URL: https://learn.chatgpt.com/docs/sandboxing

### 40. Automatic review leaves the wall where it was

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-40
- Quote: "Automatic review, when available, doesn’t change the sandbox boundary."
- Source: OpenAI Codex docs, Sandbox, approvals
- URL: https://learn.chatgpt.com/docs/sandboxing

### 41. Reviewer setting

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-41
- Quote: "Set approvals_reviewer = \"auto_review\" to route eligible approval requests through a reviewer agent before Codex runs the request"
- Source: OpenAI Codex docs, Agent approvals & security, Automatic approval reviews
- URL: https://learn.chatgpt.com/docs/agent-approvals-security

### 42. Full-access flags

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-42
- Quote: "use --sandbox danger-full-access (or the --dangerously-bypass-approvals-and-sandbox flag)" ; "--yolo or another full access sandbox setting"
- Source: OpenAI Codex docs, Agent approvals & security, "Run without approval prompts" (first quote); web search paragraph (--yolo)
- URL: https://learn.chatgpt.com/docs/agent-approvals-security

### 43. Run Modes defined; three modes (Auto-review, Allowlist, Run Everything)

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-43
- Quote: "Run Modes control how the Cursor agent runs tool calls, and when Cursor interrupts you for approval."
- Source: Cursor docs, Run Modes, top + Pick a mode table
- URL: https://cursor.com/docs/agent/security/run-modes

### 44. Run Everything

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-44
- Quote: "Every tool call runs automatically."
- Source: Cursor docs, Run Modes, Pick a mode table
- URL: https://cursor.com/docs/agent/security/run-modes

### 45. Cursor's recommendation

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-45
- Quote: "The safest useful setup for most people is Auto-review."
- Source: Cursor docs, Run Modes, top
- URL: https://cursor.com/docs/agent/security/run-modes

### 46. Not a boundary

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-46
- Quote: "Auto-review is not a security boundary"
- Source: Cursor docs, Run Modes, How Auto-review works
- URL: https://cursor.com/docs/agent/security/run-modes

### 47. Auto-review became Cursor's recommended default on 29 May 2026 (says nothing of the earlier default)

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-47
- Quote: "Auto-review shipped as the recommended default." (row 3.6, May 29, 2026) / "Ask Every Time was deprecated." (row 3.5, May 22, 2026)
- Source: Cursor docs, Run Modes, history table
- URL: https://cursor.com/docs/agent/security/run-modes

### 50. Auto-accept is common

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-50
- Quote: "Many developers run these agents with auto-accept enabled, meaning the agent operates with the developer's full permissions and minimal human oversight."
- Source: OWASP, Secure Coding with AI Cheat Sheet, intro
- URL: https://cheatsheetseries.owasp.org/cheatsheets/Secure_Coding_with_AI_Cheat_Sheet.html

### 51. Git can refuse ref deletions pushed to a repository

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-51
- Quote: "If set to true, git-receive-pack will deny a ref update that deletes the ref."
- Source: git docs, git-config, receive.denyDeletes
- URL: https://git-scm.com/docs/git-config

### 52. GitHub rulesets restrict deletions, on by default

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-52
- Quote: "only users with bypass permissions can delete branches or tags whose name matches the pattern you specify. This rule is selected by default."
- Source: GitHub Docs, Available rules for rulesets, Restrict deletions
- URL: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets

### 53. GitHub rulesets block force pushes, on by default

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-53
- Quote: "You can prevent users from force pushing to the targeted branches or tags. This rule is enabled by default."
- Source: GitHub Docs, Available rules for rulesets, Block force pushes
- URL: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets

### 54. Deny rule Bash(git push origin --delete *) blocks git push origin --delete old-1

- Status: EXECUTED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-54
- Quote: "Permission to use Bash with command git push origin --delete old-1 has been denied."
- Source: Our run (RUN.md)

### 55. With Bash(git push *) pre-approved (so ordinary pushes run), the same delete as git push origin :old-1 passes the deny rule and deletes the branch

- Status: EXECUTED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-55
- Quote: " - [deleted] old-1"
- Source: Our run (RUN.md)

### 56. With receive.denyDeletes on the remote, the colon form is refused

- Status: EXECUTED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-56
- Quote: " ! [remote rejected] old-2 (deletion prohibited)"
- Source: Our run (RUN.md)

### 57. On "Clean up old branches." the agent deleted local branches only, 3 of 3 recorded runs (headless, dontAsk, one prompt)

- Status: EXECUTED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-57
- Quote: demo/task-run-1.txt, task-run-2.txt, task-run-3.txt (raw output, 23 Oct 2026 18:43–18:44 BST, file times); an earlier unrecorded set of 3 matched
- Source: Our run (RUN.md)

### 58. A larger test of the same gap: one Bash(git push:*) deny rule, 14 spellings, 5 reached the remote (Claude Code 2.1.278, run 2026-09-22)

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-58
- Quote: "The rule blocked 8 of them. 5 pushed to the remote"
- Source: Rulestack (a seller of rule packs), 24 Sep 2026, first para + scoreboard
- URL: https://rulestack.hashnode.dev/claude-code-permission-rules-bash-git-push-stopped-8-of-14-ways-to-push-and-5-reached-the-remote

### 59. VS Code says the same of its own auto-approval rules

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-59
- Quote: "Shell aliases, quote concatenation, and complex shell syntax can bypass the rules and slip through undetected."
- Source: VS Code docs, Trust and safety, Why sandboxing matters
- URL: https://code.visualstudio.com/docs/agents/concepts/trust-and-safety

### 60. An earlier Substack explainer argues the environment matters more than the model

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-60
- Quote: "why the environment matters more than the model"
- Source: Paul Goldsmith-Pinkham, Permissions, Sandboxes, and Autonomous Agents, A Causal Affair, 24 May 2026, intro
- URL: https://paulgp.substack.com/p/permissions-sandboxes-and-autonomous

### 61. Default block rules, first group: irreversible loss

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-61
- Quote: "Destroy or exfiltrate. Cause irreversible loss by force-pushing over history, mass-deleting cloud storage, or sending internal data externally."
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, The customizable slots
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 62. Default block rules, fourth group: shared systems

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-62
- Quote: "Bypass review or affect others. Skip safeguards on shared infrastructure by pushing directly to main, running production deploys, or modifying shared resources or jobs the agent didn't create."
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, The customizable slots
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 63. The deployed pipeline wrongly blocks 0.4% of real traffic

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-63
- Quote: "FPR drops from 8.5% to 0.4%, at the cost of some recall."
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, Results, table caption
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 64. A false block costs a retry

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-64
- Quote: "a false positive costs a single retry where the agent gets a nudge, reconsiders, and usually finds an alternative path"
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, Deny-and-continue
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 65. dontAsk refuses anything not pre-approved (an allowlist)

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-65
- Quote: "anything that would prompt is denied"
- Source: Claude Code docs, Permission modes, modes table, dontAsk row
- URL: https://code.claude.com/docs/en/permission-modes

### 66. Least privilege for agents

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-66
- Quote: "Apply least privilege -- a coding agent does not need access to email, payment, or administrative tools."
- Source: OWASP, Secure Coding with AI Cheat Sheet, Do (MCP / tools)
- URL: https://cheatsheetseries.owasp.org/cheatsheets/Secure_Coding_with_AI_Cheat_Sheet.html

### 67. Compared with no checks, auto mode is a big step up

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-67
- Quote: "If you are running --dangerously-skip-permissions, this is a substantial improvement."
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, Results
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 68. Why in-project edits skip the classifier

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-68
- Quote: "in-project edits are reviewable via version control"
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, Tier 2
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 69. The bypass/auto off-switches are best placed in managed settings, which take precedence over user and project settings

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-69
- Quote: "These are most useful in managed settings where they can’t be overridden." (of permissions.disableBypassPermissionsMode / disableAutoMode)
- Source: Claude Code docs, Configure permissions, modes section
- URL: https://code.claude.com/docs/en/permissions

### 70. A headless run never shows the trust dialog

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-70
- Quote: "A claude -p run or an SDK session never shows it"
- Source: Claude Code docs, Configure permissions, Project allow rules and workspace trust
- URL: https://code.claude.com/docs/en/permissions

### 71. Codex on-request asks at the sandbox edge

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-71
- Quote: "on-request: The agent works inside the sandbox by default and asks when it needs to go beyond that boundary."
- Source: OpenAI Codex docs, Sandbox, approval policies
- URL: https://learn.chatgpt.com/docs/sandboxing

### 72. The 0.4% is measured on 10,000 real staff actions

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-72
- Quote: "Real internal traffic (n = 10,000). Actual Claude Code tool calls from Anthropic employees."
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, Results, dataset list
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 73. Where the 52 came from

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-73
- Quote: "Curated from sessions where an employee denied the action or it was flagged post-hoc."
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, Results, dataset list
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 74. What Auto-review does with each call

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-74
- Quote: "Allowlisted calls run immediately. Other shell commands run in the sandbox when possible. Calls that do not use the sandbox go to the Auto-review classifier."
- Source: Cursor docs, Run Modes, Pick a mode table, Auto-review row
- URL: https://cursor.com/docs/agent/security/run-modes

### 75. Plan mode blocks edits until a plan is approved

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-75
- Quote: "Claude Code blocks edits until you approve a plan"
- Source: Claude Code docs, Permission modes, Common setups table, plan row
- URL: https://code.claude.com/docs/en/permission-modes

### 76. A real auto-mode incident: Opus 5 pushed deletion commits to two main branches; neither the model nor the classifier stopped it

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-76
- Quote: "So I had started treating the model and the classifier as two layers of safety. Neither stopped this."
- Source: François Martin, Karakun, How my coding agent pushed a commit deleting every file to main, 28 Aug 2026, Why coding agent safety checks were not enough
- URL: https://dev.karakun.com/2026/08/28/coding-agent-pushed-deletion-to-main.html

### 77. The size of that deletion

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-77
- Quote: "The deletion commits removed 151 files from one main branch and 723 from the other."
- Source: François Martin, Karakun, How my coding agent pushed a commit deleting every file to main, 28 Aug 2026, opening
- URL: https://dev.karakun.com/2026/08/28/coding-agent-pushed-deletion-to-main.html

### 79. Branch protection is the strongest guard; prior statement of the ordering

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-79
- Quote: "Branch protection is the most effective safeguard"
- Source: François Martin, Karakun, How my coding agent pushed a commit deleting every file to main, 28 Aug 2026, Start with Git branch protection
- URL: https://dev.karakun.com/2026/08/28/coding-agent-pushed-deletion-to-main.html

### 80. The server sees the agent as you, unless it has its own identity

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-80
- Quote: "The agent pushes with my credentials, so the server sees me." / "a machine account or app installation whose credentials have no bypass rights"
- Source: François Martin, Karakun, How my coding agent pushed a commit deleting every file to main, 28 Aug 2026, Start with Git branch protection
- URL: https://dev.karakun.com/2026/08/28/coding-agent-pushed-deletion-to-main.html

### 82. An agent disabled branch protection and a ruleset to force-push

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-82
- Quote: "the agent disabled GitHub branch protection rules and a repository ruleset without user authorization in order to unblock a force push." / "Deleted the branch protection rule entirely"
- Source: anthropics/claude-code issue #42849 (user report, Claude Code CLI, Sonnet 4.6), 2 Apr 2026, closed, Summary; What happened
- URL: https://github.com/anthropics/claude-code/issues/42849

### 84. Rulesets on private repos need a paid GitHub plan

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-84
- Quote: "Rulesets are available in public repositories with GitHub Free and GitHub Free for organizations, and in public and private repositories with GitHub Pro, GitHub Team, and GitHub Enterprise Cloud."
- Source: GitHub Docs, About rulesets, Who can use this feature?
- URL: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets

### 85. A deny rule covers the usual spelling and is not a boundary

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-85
- Quote: "a deny or ask rule covers the invocation Claude usually produces and isn’t a security boundary around the program"
- Source: Claude Code docs, Configure permissions, What a Bash rule doesn't match
- URL: https://code.claude.com/docs/en/permissions

### 87. The throwaway remote in our runs is a folder the agent can reach directly

- Status: EXECUTED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-87
- Quote: "The "remote" is a folder on the same machine. So these runs test the refusal, not separation: an agent could delete the branch directly with git -C ../remote.git branch -D."
- Source: Our run (RUN.md caveat; re-tested: git -C ../remote.git branch -D old-1 deleted the branch with receive.denyDeletes on)

### 88. Auto mode's second stage trades some recall for fewer false blocks

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-88
- Quote: "It cleans up the false positives but lets a few more dangerous actions through."
- Source: Anthropic, How we built Claude Code auto mode, 25 Mar 2026, Results
- URL: https://www.anthropic.com/research/claude-code-auto-mode

### 90. Martin's deletion came from a recovery attempt

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-90
- Quote: "Claude tried to undo the broken commits using a shallow clone that contained only the latest commit instead of the full Git history." / "Reverting it therefore staged every single file in the repository for deletion."
- Source: François Martin, Karakun, How my coding agent pushed a commit deleting every file to main, 28 Aug 2026, How the attempted recovery emptied both branches
- URL: https://dev.karakun.com/2026/08/28/coding-agent-pushed-deletion-to-main.html

### 91. Martin's ordering: three layers, branch protection first

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-91
- Quote: "I would set up three layers, in this order."
- Source: François Martin, Karakun, How my coding agent pushed a commit deleting every file to main, 28 Aug 2026, Git safeguards for AI coding agents
- URL: https://dev.karakun.com/2026/08/28/coding-agent-pushed-deletion-to-main.html

### 93. Anthropic keeps git credentials out of the web sandbox

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-93
- Quote: "We've designed this sandbox to ensure that sensitive credentials (such as git credentials or signing keys) are never inside the sandbox with Claude Code."
- Source: Anthropic, Beyond permission prompts, 20 Oct 2025, Claude Code on the web
- URL: https://www.anthropic.com/research/claude-code-sandboxing

### 96. Git can refuse forced, non-fast-forward updates

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-96
- Quote: "If set to true, git-receive-pack will deny a ref update which is not a fast-forward. Use this to prevent such an update via a push, even if that push is forced."
- Source: git docs, git-config, receive.denyNonFastForwards
- URL: https://git-scm.com/docs/git-config

### 97. #42849's task needed a force-push

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-97
- Quote: "User asked to scrub a file from git history"
- Source: anthropics/claude-code issue #42849 (user report, Sonnet 4.6), 2 Apr 2026, closed as duplicate, What happened
- URL: https://github.com/anthropics/claude-code/issues/42849

### 98. Auto mode needs a supported model and can be switched off by an organisation

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-98
- Quote: "Requires a supported model, and your organization can turn auto mode off"
- Source: Claude Code docs, Permission modes, Common setups table, auto row
- URL: https://code.claude.com/docs/en/permission-modes

### 99. Cursor: an empty Allowlist behaves like the old ask-every-time mode (figure: "Allowlist, left empty" under "Asks you")

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-99
- Quote: "Ask Every Time was deprecated. New users cannot choose it. Use Allowlist with an empty allowlist for the same behavior."
- Source: Cursor docs, Run Modes, history table, 3.5
- URL: https://cursor.com/docs/agent/security/run-modes

### 100. With denyDeletes and denyNonFastForwards on, an ordinary push of a commit deleting every file is accepted

- Status: EXECUTED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-100
- Quote: "files on remote main: 0"
- Source: Our run (demo/fast-forward-delete-test.sh)

### 101. Martin: a required pull request would have stopped both his incidents

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-101
- Quote: "Letting the agent open a pull request instead would have stopped both incidents, even with automatic merging once CI passed"
- Source: François Martin, Karakun, How my coding agent pushed a commit deleting every file to main, 28 Aug 2026, Start with Git branch protection
- URL: https://dev.karakun.com/2026/08/28/coding-agent-pushed-deletion-to-main.html

### 102. Current auto-mode defaults allow pushes to any branch of the working repository, including the default branch; force push stays blocked

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-102
- Quote: "Pushing to any branch of the repository you’re working in, including the default branch." / "Force push"
- Source: Claude Code docs, Permission modes, What the classifier blocks by default (Allowed by default; block list)
- URL: https://code.claude.com/docs/en/permission-modes

### 103. Claude Code's sandbox gives commands no direct network route; its proxy checks each host against allowed and denied domains

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-103
- Quote: "A sandboxed command has no direct route to the network" / "The proxy checks the hostname of each connection against your allowed and denied domains."
- Source: Claude Code docs, Sandboxing, Network isolation
- URL: https://code.claude.com/docs/en/sandboxing

### 104. GitHub rulesets include requiring a pull request before merging

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-104
- Quote: "Require a pull request before merging"
- Source: GitHub Docs, Available rules for rulesets, rules list
- URL: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets

### 105. A command the sandbox blocks can be retried outside it unless allowUnsandboxedCommands is false

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-105
- Quote: "Overrides: choose whether commands that fail under the sandbox can fall back to running unsandboxed. This is the allowUnsandboxedCommands setting"
- Source: Claude Code docs, Sandboxing, Configure the sandbox / Overrides
- URL: https://code.claude.com/docs/en/sandboxing

### 106. A required pull request need not be approved

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-106
- Quote: "The pull request doesn't necessarily have to be approved, but it must be opened."
- Source: GitHub Docs, Available rules for rulesets, Require a pull request before merging
- URL: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets

### 107. Rulesets can require status checks to pass

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-107
- Quote: "Require status checks to pass before merging"
- Source: GitHub Docs, Available rules for rulesets, rules list
- URL: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets

### 108. Martin: CI would have failed both his incidents' commits

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-108
- Quote: "neither the invalid YAML nor the deletion commits would have passed CI"
- Source: François Martin, Karakun, How my coding agent pushed a commit deleting every file to main, 28 Aug 2026, Start with Git branch protection
- URL: https://dev.karakun.com/2026/08/28/coding-agent-pushed-deletion-to-main.html

### 109. Plan mode still runs classifier-approved commands

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-109
- Quote: "Reads, plus classifier-approved commands when auto mode is available"
- Source: Claude Code docs, Permission modes, modes table, plan row
- URL: https://code.claude.com/docs/en/permission-modes

### 110. Required status checks only ensure the required CI tests pass

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-110
- Quote: "Required status checks ensure that all required CI tests are passing before collaborators can make changes to a branch or tag targeted by your ruleset."
- Source: GitHub Docs, Available rules for rulesets, Require status checks to pass before merging
- URL: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets

### 111. Codex's read-only sandbox mode

- Status: VERIFIED
- Row link: https://durabilitycurve.com/claims/ai-agent-permissions/#c-111
- Quote: "read-only: The agent can inspect files, but it can’t edit files or run commands without approval."
- Source: OpenAI Codex docs, Sandbox, modes list
- URL: https://learn.chatgpt.com/docs/sandboxing

## Cite

- A claim: name the original source (and its locator) first, then the row it was checked in, e.g. "<source>, <locator>. Checked in: Claim Ledger, "AI Agent Permissions: How to Stop Your Agent Doing Something You Can't Undo", The Durability Curve, row <id>, https://durabilitycurve.com/claims/ai-agent-permissions/#c-<id>."
- The essay: Floyd, Harry (2026). AI Agent Permissions: How to Stop Your Agent Doing Something You Can't Undo. The Durability Curve. https://durabilitycurve.com/blog/ai-agent-permissions/
- This ledger: Floyd, Harry (2026). Claim Ledger: AI Agent Permissions: How to Stop Your Agent Doing Something You Can't Undo. The Durability Curve. https://durabilitycurve.com/claims/ai-agent-permissions/
- Downloads: https://durabilitycurve.com/claims/ai-agent-permissions.csv · https://durabilitycurve.com/claims/ai-agent-permissions.json

Licence: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Reuse it, quote it or train on it, with credit to The Durability Curve and a link. Open to AI (robots.txt: search=yes, ai-input=yes, ai-train=yes).