Tagged permissions · show all articles
Claude Code ships its own permission system, hooks, subagents, and memory files. Each is documented, each has already failed in a specific and traceable way, and each failure is distinct from a generic "AI agent risk."
Claude stops when the work looks done. Turning that into more than a feeling takes four separate mechanisms: a check with a real oracle, a hook that cannot be argued with, a sandbox bounding the damage, and a human gate outside the loop.
Claude Code is not a chatbot with a code icon. It is an agentic harness: a loop that calls a model, executes real shell and filesystem operations behind a permission gate, and manages a shrinking context budget one turn at a time.