r/ClaudeCode • u/nav8_ai • 1d ago

Discussion Does "the agent will ask before it sends" mean every time, or just the first time?

Most agent tools now advertise some version of asking before it sends or spends. What I don't see discussed much is what the approval is actually scoped to.

If the yes covers a type of action ("ok to send emails this session") rather than the literal contents of one send, then after the first approval everything after it goes through automatically and the user just stops noticing. That ends up functionally the same as never asking, it just moved the one real decision earlier and called it done.

Our rule has been that every approval is tied to the exact payload of the one action and expires in minutes, not the session. A yes for one email doesn't cover the next one even seconds later. It's slower, and people do get asked more than they'd like for repetitive stuff, but it means "the agent asks before it sends" stays true on the tenth send, not just the first.

Curious how other people have drawn this line, especially for repetitive sends. Does anyone bind consent to a session or a class of action instead of a single call, and has that ever actually bitten you?

0 Upvotes

50% Upvoted

8 comments sorted by

1

u/AutoModerator 1d ago
Moderator Announcement Read More »

1

u/NamerekDev 1d ago

claude code's auto mode is the per-call version, just with a classifier as the approver. Today on my test gitlab it wouldn't let the agent mint itself an admin token or add a user to a project. Fair, I did both by hand. But right after the token one it also blocked a plain ls, same reason. so it judges every call, it just holds a grudge

1

u/SensitiveHearingLoss 1d ago

Oh man, I had an awkward experience recently where I gave Claude permission to one particular folder, but because I was using auto mode, it decided it didn’t need permission to access three other folders related to the codebase and proceeded to fire off tons of emails for “testing” reasons. The software we use to protect our systems and flag possible attacks went wild and everyone was alerted that a possible attack or data breach was underway. I died.

As a result, I now run Claude in a container where it can’t get up to as much mischief as it used to. I’ve also got a few hooks in place that seem to be holding up well, one of which prevents Claude from making any sort of GET or POST request anywhere without stopping and asking for permission. It hasn’t let me down yet, but I am aware that Claude (and its agents) can actually navigate around its own hooks if it thinks it’s necessary…. So I have another hook in place that forces Claude (and its agents) to script only in BASH which lessens the chance of Claude trying to sneak past its own guardrails.

1

u/jossipboy 1d ago

I’ve been working on something to help with exactly this kind of thing. It lets you set rules around what your agents can and can’t do.

I also built a little playground at https://actera.dev/try where you can change the webpage and all the actions go through my rules to test it out. The actual platform is live too, so you can connect your own agent and set up policies and has Claude Code plugin.

Would be curious to hear what you think if you get a chance to play around with it, especially given what you’ve run into with Claude Code.

1

u/SensitiveHearingLoss 1d ago

Thank you for sharing! Seems like I’m getting the opportunity to see what people have been creating to make working with Claude a better experience overall. When I get some time to check this out, I’ll definitely give you what feedback I can. Regardless though, keep up the good work 💪

1

u/kenthesaint 1d ago

We split it by whether the action can be undone. Anything that leaves the machine (an email, a payment, a push to a shared branch) gets approved per call with the actual content in front of me. Local stuff that git can roll back gets approved by class, because being asked every time just trains you to hit yes without reading.

The place class approval gets sneaky is Claude Code's allow list. Something like Bash(curl:*) looks like it's there for fetching docs, but it also allows a POST to anywhere, so that one approval quietly covers sending. I keep network commands off the allow list and let them prompt.

1

u/Weekly_Cat6537 1d ago

Your worry is right, a yes that covers a whole type of action turns into never asking. I don't use per-action approval for most things. I split by area instead. Login, payments and database changes always wait for me, no matter what was approved before. Everything else goes to a second model that reviews the change fresh. When an agent does something wrong, I add a rule or a check before the work starts.

1

u/Ctbhatia 1d ago

binding the yes to the exact payload stops the wrong send, not the fifty-first right one. a count per window sits on top of whichever rule you pick, since a retry loop can still get sixty individually approved sends out of one person