The safeguards map / 3.2 Agent harnesses
Claude Code
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
A coding agent with permission modes, allow, ask and deny rules, hooks that can block tool calls, and settings an administrator can enforce.
Where it sits
3.2 Agent harnesses (primary): Asks for approval before tool calls according to the active permission mode and the user's allow, ask and deny rules, and runs hooks that can block a tool call.
Claude Code uses a tiered permission system to balance power and safety.
captured
Claude Code supports several permission modes that control how it approves tool calls.
captured
Before a tool call executes. Can block it
captured
Facts
- Concern
- safetysecurity
- Names the law
- no
- Subject
- agent
- Used by
- those who run it
- Runs
- at runtime
- Policy comes from
- owner-entered settingsan external decision point
- Can the agent bypass it
- depends
Handoffs
produces Runtime records: OpenTelemetry (OTel) metrics, events and traces
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.