11. Securing Autonomous Agents (Permissions, Auto Mode and the Sandbox)

<p>In Episode 11 of <strong>Beyond Prompting</strong>, author Sho Shimoda breaks down the permission and governance architecture that protects your host machine while allowing Claude Code to operate autonomously. As session defaults shift toward classifier-driven execution, understanding how actions are evaluated is essential for safe operation. In this episode, we cover:</p><ul><ul><li><strong>First-Match Resolution Order:</strong> How proposed tool calls evaluate in a strict, fixed sequence—Deny rules first, then Ask rules, then Allow rules, before falling through to session permission modes and the classifier.</li></ul><ul><li><strong>The Six Permission Modes:</strong> Navigating session postures—Manual, Accept Edits, Plan, Auto, Don&#39;t Ask, and Bypass Permissions—and understanding how settings merge additively across scopes rather than replacing team defaults.</li></ul><ul><li><strong>Auto Mode &amp; The Classifier:</strong> How a Sonnet 5 classifier evaluates proposed tool calls in real time while enforcing protected paths (like .git, .vscode, and .claude) and critical deletion paths regardless of user allow rules.</li></ul><ul><li><strong>The OS-Level Sandbox Boundary:</strong> Distinguishing between client-side permission controls and true operating system isolation (Seatbelt on macOS, bubblewrap on Linux/WSL2) that constrains shell command execution even if prompt injection occurs.</li></ul></ul><p><em>(Note for listeners: This episode covers Chapter 11 of Sho Shimoda&#39;s book </em><a href="https://www.amazon.com/dp/B0HJKBWKVQ" target="_blank" rel="noopener noreferer"><strong>RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code</strong></a><em>, available on Amazon as the successor book to </em><strong>Master Claude: Chat, Cowork and Code</strong><em>).</em></p>