Permissions Blast Radius Question Explained
This worked Loop Engineering practice question tests Limits and Safety. Try the answer first, then review why C is the best choice.
Short answer
The correct answer is C. Run it in a dedicated folder with deny rules or an OS-level sandbox.
By default Claude has access to the directory where you launched it, so a dedicated practice folder is the first boundary. The CLI reference says --allowedTools lists tools that run without prompting. To restrict tools you use --tools and deny rules. The permissions docs describe OS-level sandboxing for shell commands. A file list in the prompt states your intent, but it does not block access to other files. The correct answer is C. Run it in a dedicated folder with deny rules or an OS-level sandbox
The Question
You plan to run a loop unattended on a laptop that also holds client repositories and personal documents. Which setup actually limits what the loop can touch?
Why C is correct
By default Claude has access to the directory where you launched it, so a dedicated practice folder is the first boundary. The CLI reference says --allowedTools lists tools that run without prompting. To restrict tools you use --tools and deny rules. The permissions docs describe OS-level sandboxing for shell commands. A file list in the prompt states your intent, but it does not block access to other files. The correct answer is C. Run it in a dedicated folder with deny rules or an OS-level sandbox
Why the other options are wrong
--allowedTools auto-approves. It removes prompts; it does not shrink what Claude can reach, so it widens the blast radius for an unattended run.
A prompt instruction is context, not enforcement. Claude usually follows it, but no permission check blocks an edit to another file.
The permissions docs say to use bypass permissions only in isolated environments such as containers or VMs. A laptop full of client repos is the opposite.
Key idea: Limits and Safety
Loop engineering is a practice skill. Open Claude Code in a throwaway folder, write one small task in a file, and run it with /loop or /goal while you watch. If you doubt an answer, test it against a real run in that folder.
Ready to test the full skill?
Take the free Loop Engineering quiz and find the exact basics to review next. No signup required.
Practice related questions
Same skill area or adjacent concept. Use these after reviewing the explanation.