Running Claude Safely.

How this fits in the OS.

The fear, named.

What keeps most people from jumping into Claude Code is not technical. It is the quiet worry that the agent will do something you cannot undo. Delete the wrong folder. Send the wrong message. Leak the wrong key. For a lot of people that worry is enough to keep them from starting at all, and for the ones who do start, it is what stalls them out in the first week.

That worry is reasonable. It also has a complete answer. A safe agent is not a careful agent. A safe agent is one running inside a system where:

• You decide what it can do without asking.
• Your credentials live somewhere it cannot freely read.
• Every file change is reversible.
• You can stop it cold with one command.

Four layers. Set them up once and the fear goes away, because the worst-case mistake is now recoverable.

Layer 1. The permissions ladder.

Claude Code has a Mode menu that controls how much it does before checking with you. You will see these names in the interface, so they are worth knowing:

• Ask before acting (the default) asks before every file edit, command, and tool call. Where day one lives. The workshop's /safe command snaps you back here.
• Auto-accept edits approves the agent's file edits but still asks before it runs a command. A small step up from asking about everything.
• Plan mode has the agent write out what it intends to do and wait for your approval before it runs anything. A sidestep you can take from any mode.
• Auto mode lets the agent decide what is safe to run without asking, with safeguards against prompt injection. The first time you pick it in a folder, it asks you to confirm once.
• Bypass permissions removes the prompts entirely. It stays switched off until you enable it in settings, and only belongs there once every other layer in this card is in place.

Treat them as a ladder you climb on purpose: start in the default, move up as you learn to predict what the agent will do, and earn Bypass last. The exact labels differ a little between VS Code and the desktop app; the full tour of every mode, how you switch between them, and which ones you have to turn on first is the companion primer, The Modes Claude Can Run In.

Layer 2. Credentials in a vault, never in chat.

The single most expensive mistake a new user can make is pasting an API key into a Claude conversation. That key is now in a chat log. It might be cached, reviewed, or replayed. Treat it as burned. Rotate it.

The fix is structural, not behavioral. You stop trusting yourself to be careful and you put the credentials somewhere Claude has to reach for them through a controlled door.

The workshop's recommended manager is Infisical, and the installer sets it up for you; 1Password works the same way if you prefer it. The full setup walkthrough lives on the Secrets Management card. Either manager works the same way for the discipline below:

• You create a dedicated vault (or project) that only holds the credentials your agents use. Personal passwords stay separate, where the agent cannot see them.
• Your CLIs and skills read credentials at runtime using a placeholder pattern. The real key never appears in your code, your prompts, or your chat history. The agent fetches it on demand and the value lives in memory for the moment it is needed.

This is also the layer that unlocks overnight work. A token scoped to read just that one vault, a machine identity in Infisical or a service account in 1Password, is what lets an agent keep working while you sleep instead of stopping every few minutes to ask you to re-authenticate. Pre-approve the handful of operations it needs, scope the token to that single vault, and an overnight run never has to wake you at 3 a.m. for a credential.

Layer 3. Version control is your time machine.

The agent is going to edit your files. That is the whole point. The question is whether any of those edits are permanent.

The answer is: not if your folder is under git. Every change Claude makes is a diff you can read, accept, or throw away. Every state of every file is recoverable. "Undo the last thing the agent did" is a one-line command. So is "undo everything since this morning."

This changes the felt risk of every other layer. The reason you can climb the permissions ladder at all is because the worst-case outcome of a bad edit is "roll back to ten minutes ago." It is not a real loss. It is a save state you reload.

The companion primer on this is GitHub for Knowledge Work. The short version for here: if your workshop folder is on git, you have a kill-switch for edits built in. If it is not, fix that before you turn on auto-approve for anything.

Layer 4. The kill switch.

The last layer is the most boring and the most reassuring. You can always stop the agent.

• Stop what it is doing right now. Press Esc, or click the stop button in the desktop app. The action in flight is cancelled and the agent waits for you.
• End the session. In the terminal, type /exit or close the window and the process ends. In the desktop app, know that work can keep running in the background: a session's subagents and background commands show up in the tasks pane where you can stop them, and a Remote session runs on Anthropic's cloud and keeps going even if you close the app. Stop those on purpose rather than assuming a closed window killed them.
• Pull every standing permission. Run /safe. It clears your auto-approve settings and drops you back to the default, so the next action needs your explicit yes before anything happens.

Knowing the stop switch is always there is the reason you can let the agent try things in the first place.

What changes for you.

The agent gets faster the more you trust it, and you only trust it because the four layers above make the worst case affordable. Three shifts you'll feel:

• You stop watching every keystroke. Auto mode does the watching for you, only stopping to ask when something genuinely new is about to happen.
• You stop being scared of credentials. Once keys live in the vault and load through placeholders, the worry that "I might leak something" becomes "the system will not let me leak something."
• You start running things overnight. The first time the agent works for eight hours while you sleep and you wake up to a finished project, the fear becomes something else. The layers in this card are what make that night possible.

Where to go next.

You have the safety net. A few natural next moves to start using it: