Topic

Agent Permission Controls

Auto-approval, allow/deny rules and pattern-based gating that determine whether agent-proposed commands actually execute.

Current stories

buildOne report1 publisher

On Enterprise and API accounts, Claude Code's default mode meters a Sonnet 5 check per shell command

Claude Code v2.1.283 makes auto mode the default, so each shell command gets a Sonnet 5 safety check metered as tokens on Enterprise, API and cloud accounts. Teams on those accounts now pay for command approval unless they choose a different permission mode.

Publishers:dev.to

Reality

Evidence55
Adoption: Not scored
Hype gap0
Incentives: Not scored
Confidence55

buildConfirmed5 publishers

Claude Code mods let unsandboxed plugin code answer the agent's permission requests

Anthropic's Claude Code mods, on by default from 2.1.287, let JavaScript or TypeScript code rewrite prompts, block tool calls and approve permission requests. For teams, the governance question moves from what the agent is told to which code it runs.

Publishers:claude.com dev.to runtimewire.com the-decoder.com thenewstack.io

Perspective Coverage

5 publishers

Builder: Builder 59%
Operator: Operator 36%
Investor: Investor 5%

Reality

Evidence78
Adoption15
Hype gap+15
Incentives60
Confidence72

buildOne report1 publisher

Five non-literal git push spellings evaded Claude Code's committed deny rule

A single Bash(git push:*) entry in a throwaway repo's .claude/settings.json stopped 8 of 14 ways to push under Claude Code 2.1.278. The five that landed wrapped the command in git -c, quotes, sh -c, eval and a script file.

Publishers:dev.to

Reality

Evidence68
Adoption18
Hype gap−8
Incentives32
Confidence60

buildConfirmed4 publishers

Claude Code's AGENTS.md fallback can be disabled by version, settings, or first-run conditions, not just feature-flag fetches

Anthropic shipped the AGENTS.md fallback in Claude Code 2.1.277 as a flag-gated built-in mod. Two machines on the same pinned version can load different project instructions. The same week's digest also logs a reverted deny-rule fix.

Publishers:dev.to developers.openai.com runtimewire.com simonwillison.net

Perspective Coverage

4 publishers

Builder: Builder 52%
Operator: Operator 39%
Investor: Investor 9%

Reality

Evidence78
Adoption62
Hype gap−6
Incentives58
Confidence74

buildOne report1 publisher

A LoRA that waits for a date: poisoned weights plus auto-approve is one boundary

A custom Qwen 3.5 2B adapter returned a shell command when OpenCode's prompt said September 1st, 2026. The harness was running with auto-approval, and the numbers are one researcher's.

Publishers:runtimewire.com

Reality

Evidence44
Adoption18
Hype gap+8
Incentives44
Confidence52