RU
Get in touch
Chapter 24

Claude Code: Configure Permissions, Sandbox, Hooks, and Automation

Permission rules, the OS sandbox, and hooks have different boundaries. For scripts Claude Code provides a non-interactive mode, but safe automation requires an explicit tool allowlist, a bounded environment, and independent verification of the result.

The three layers and their important boundaries are worth keeping in view.

Layer · What it controls · Important boundary

  • Permissions - Allow, ask, or deny a tool call; Applied to the tool surface
  • Sandbox - Filesystem and network for the Bash subprocess tree; MCP servers and hooks don't become its children automatically
  • Hooks - A deterministic reaction to a lifecycle event; A hook is itself executable code

The built-in sandbox uses Seatbelt on macOS and bubblewrap on Linux/WSL2, and the /sandbox command manages configuration; to also isolate MCP and hooks, the docs recommend a sandbox or container around the whole process. Custom subagents in .claude/agents/ have their own context and tool restrictions - useful for exploration and independent verification, but they add cost and don't inherit the conversation history, so the parent must pass them the contract.

For automation there's print mode - and it has its own boundaries.

Bash
# Print mode
claude -p "Review the current diff and return findings"

# Limit tools with the documented flag
claude -p --allowedTools "Read,Grep" "Audit the repository without edits"

# --bare skips CLAUDE.md, hooks, skills, plugins, MCP and auto memory
# Use it only when that deterministic reduction is intentional.

The --bare flag is meant for a minimal predictable context: it turns off CLAUDE.md, hooks, skills, plugins, MCP, and auto memory. It's not a "smarter" mode but a deliberate reduction.

Don't turn off permissions on a host with secrets. The bypass-permissions flag is documented as risky. If an unattended run is truly needed, first create a separate container or VM, a minimal credential set, and server-side authorization. Checkpoints track only Claude's own edits - changes via Bash may not land in them, so keep Git clean.

Claude Code is covered. The third product is the most editor-oriented - that's Cursor.

Links