# Prose Configuration Cannot Substitute for a Real Access Boundary ## Claim A deny rule written into an agent's configuration file reduces accidental mistakes, but it doesn't function as a security boundary — only an external enforcement mechanism the agent can't rewrite or route around does that. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Applies to Claude Code's `settings.json` deny rules specifically, and generalizes to any agent-configuration-layer "don't do X" instruction. - The claim doesn't say prose configuration is useless — it's a workflow guardrail that catches ordinary mistakes; the gap is specifically for a determined bypass or a genuinely high-consequence action. - Real enforcement requires the boundary to sit outside the agent's own reasoning — OS permissions, sandboxing, credential scoping, or an external gate the agent can't reclassify itself out of. ## Evidence Oleg Efimov states plainly that "deny rules in settings.json are not a reliable security boundary," positioning CLAUDE.md and settings.json as operational guidance rather than enforcement, and reserving actual security controls for the operating-system or sandbox layer. The article doesn't demonstrate a concrete bypass, so the claim rests on the general architecture point (the agent that reads the rule is the same agent the rule is meant to constrain) rather than a documented exploit. ## Links - [[AI & the Future of Knowledge Work MOC]] — the difference between reducing accidents and enforcing a limit - [[3. Resources/Permanent Notes/A Control Is Enforceable Only When the Actor Cannot Reclassify It]] — because evidence-for; a second, independent source (developer tooling configuration, rather than an agent-migration incident) making the same enforceable-layer argument. - [[3. Resources/MOCs/AI Agent Safety MOC]] — because applies-in; directly names where Claude Code's own settings sit on the advisory-vs-enforced spectrum. ## Tests / falsifiers - Find a documented case where a Claude Code deny rule successfully blocked a determined attempt to perform the denied action (not just an accidental one) — would weaken the "not reliable" claim. - Find a Claude Code release where deny rules are backed by an external enforcement layer (sandboxed execution, OS permissions) rather than being read as prose — would mean the claim no longer applies to that configuration. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Literature Notes/Navigating Claude Code - The Bare Minimum Setup]] — states the deny-rules-not-a-security-boundary claim directly.