Act II continues. This is the gate you put up **before** you let Claude Code run unattended. We build three independent enforcement layers, because they fail differently, and you need all three. **The three pillars** - **Sandboxing.** The native Bash sandbox ([docs](https://code.claude.com/docs/en/sandboxing)) enforced by the OS: Seatbelt on macOS, bubblewrap + socat on Linux/WSL2 (`sudo apt-get install bubblewrap socat`). Default write is the working dir only; default read is the **whole computer except denied dirs**, which still includes `~/.aws/credentials` and `~/.ssh` unless you add `denyRead`. Network has no domains pre-allowed; the proxy does not inspect TLS, so broad domains like `github.com` are exfil paths. Key knobs: `failIfUnavailable`, `allowUnsandboxedCommands`, `excludedCommands`, `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB`. - **Permissions & modes.** Evaluation is deny then ask then allow, first match wins ([Permissions](https://code.claude.com/docs/en/permissions)). `dontAsk` is the unattended gem (fully non-interactive). `--dangerously-skip-permissions` is the anti-pattern: it replaces the prompt with *nothing* and offers no injection protection ([Permission modes](https://code.claude.com/docs/en/permission-modes)). Watch the gitignore-anchor footgun: `/Users/alice/file` is project-relative, not absolute. - **Prompt-injection defense.** The lethal trifecta (private data + untrusted content + exfil channel). The patched Claude Code GitHub Action attack ([Microsoft](https://www.microsoft.com/en-us/security/blog/2026/06/05/securing-ci-cd-in-agentic-world-claude-code-github-action-case/), [oddguan](https://oddguan.com/blog/comment-and-control-prompt-injection-credential-theft-claude-code-gemini-cli-github-copilot/), [GMO Flatt](https://flatt.tech/research/posts/poisoning-claude-code-one-github-issue-to-break-the-supply-chain/)): the Read tool bypassed the Bash sandbox and leaked `/proc/self/environ`. Fixed in claude-code-action **v1.0.94**. Plus [auto mode](https://www.anthropic.com/engineering/claude-code-auto-mode), [Security](https://code.claude.com/docs/en/security), and PreToolUse [hooks](https://code.claude.com/docs/en/hooks). - **Audit logs.** On-disk JSONL transcripts ([.claude directory](https://code.claude.com/docs/en/claude-directory), unencrypted at rest), headless `--output-format json` with `total_cost_usd` ([headless](https://code.claude.com/docs/en/headless)), and [OpenTelemetry](https://code.claude.com/docs/en/monitoring-usage) emitting `claude_code.tool_decision` and `claude_code.tool_result` out of the box. We close with one copyable locked-down headless workflow and the primary pitfall: the silent success of `--dangerously-skip-permissions`. Forward pointer: blast-radius engineering, next episode. **News:** Fable 5 and Mythos 5 [pulled under a US export-control directive](https://www.anthropic.com/news/fable-mythos-access); Claude Code falls back to Opus 4.8 (switch with `/model`). Plus the v2.1.172–2.1.176 [changelog](https://code.claude.com/docs/en/changelog) hardening: `enforceAvailableModels`, nested sub-agents to 5 levels, and fixed permission-path matching.