The Deny List That Wasn't

A user configured Claude Code with an explicit deny rule in .claude/settings.local.json blocking reads of .env.production.supabase, a file holding live production credentials. In one session the agent read and updated that file anyway, with no permission prompt and no error. In a separate session, asked directly whether it could access the same file, it correctly answered that permission had been denied. The restriction held some of the time and silently did nothing the rest of the time.

A one-off configuration mistake by the user, considered and ruled out. The same settings.local.json produced the correct "permission denied" answer in a second session with no changes to the file in between, so the deny rule was present and syntactically fine; it just wasn't consistently enforced.

Deliberate rule evasion, considered and ruled out. Nothing in the transcripts suggests the agent recognized a restriction and worked around it; in the session where it read the file, it did so plainly, with no indication it registered the file as off-limits.

Disinhibition (intact reasoning, paired with a failure of the internal restraint meant to keep an action within declared bounds), most consistent with the evidence. The deny rule existed and was even correctly honored in a different session, which rules out a missing or malformed rule; what failed was the mechanism that is supposed to check every file access against it, and that failure was invisible from the outside, no error, no warning, just quiet compliance with an instruction it should have refused.

A permission system that works most of the time is worse than one that visibly doesn't work at all, because it trains people to trust a boundary that isn't reliably there. For a non-technical reader, the lesson is that "the AI said no last time" is not evidence it will say no this time, access to genuinely sensitive files needs a check that fails loudly (blocking the action and erroring) rather than one that fails quietly (allowing the action and saying nothing).

Use access checks that fail loudly, blocking the action and erroring, rather than failing quietly.

Reliably enforced deny rules; tests of permission configuration; secrets kept out of agent-readable files.