Permissions

Allow lists, deny lists, approval modes and credentials for coding agents.

Permission rules decide what an agent may do without asking, what it must ask about and what it may never do. These guides cover allow and deny rules, approval modes and keeping powerful credentials out of the agent's reach.

• How to give an AI coding agent read-only access to your production database

  October 31, 2026

  Create a dedicated database role with SELECT-only grants, add timeouts, point it at a replica if you can, and keep owner credentials out of the agent's reach.

• How to stop Claude Code from running destructive commands

  October 31, 2026

  Use deny rules, a PreToolUse hook that exits with code 2, the Bash sandbox and least-privilege credentials so Claude Code can't drop tables or delete infrastructure.

Browse by topic

• Claude Code: Running Anthropic's Claude Code safely: hooks, permissions, settings and guardrails.
• Hooks: Using agent hooks to check, warn about or block an action before it runs.
• Databases: Protecting production databases from destructive queries and unsafe migrations by AI agents.
• Infrastructure: Keeping agents from deleting or changing cloud infrastructure, Terraform state and Kubernetes resources.
• Incidents: Public incidents where AI coding agents broke something, and what they teach.
• Guardrails: The general practice of putting safety checks between an AI agent and the systems it can change.