modul 4 — scaling yourself
permissions: how much rope
Approving every action doesn't scale; approving nothing is negligence. Permission rules, modes, and the sandbox let you set trust per action instead of per session.
~2 min read · ~9 min with the exercise · v1.0 · verified: 2026-07-15
trust is a setting, and instructions aren't
Every "allow this?" prompt buys you safety and costs you flow. Click yes forty times a day and you stop reading what you approve, which is worse than either extreme. The scaling answer: decide trust once, per action class, in configuration.
One sentence from the permissions docs carries the whole lesson: "Permission rules are enforced by Claude Code, not by the model." A rule in CLAUDE.md shapes what the agent tries; a permission rule decides what the tool allows. This is the same instruction-versus-guarantee line module 2's hooks lesson drew, applied to access.