Protected Paths & Sandboxing

To prevent accidents or malicious injections, Claude Code has built-in guardrails that transcend standard permission modes.

Protected Paths

Even in acceptEdits or auto mode, Claude will always prompt for approval before writing to these paths:

• Directories: .git, .vscode, .idea, .husky, .claude (with exceptions like agents).
• Files: .gitconfig, .bashrc, .zshrc, .profile, .mcp.json.

Sandboxing

Permissions and sandboxing are complementary layers:

• Permissions: Control if Claude decides to use a tool.
• Sandboxing: OS-level isolation that restricts what the tool (Bash) can actually see or touch.

Defense in Depth

1. Deny Rules: Prevent the agent from even trying a tool.
2. Classifier (Auto Mode): Vets the intent of the tool call.
3. Sandbox: Prevents a prompt injection from bypassing logic to access forbidden resources.

Note: Enabling sandboxing and setting autoAllowBashIfSandboxed: true will stop prompting for Bash actions, as the sandbox boundary replaces the prompt.