The permission map every Claude Code agent needs (and the column most teams skip)

The question that matters more than "does the agent work"

Over the past several months I've been running structural governance checks on AI coding agents — mainly Claude Code — across a handful of active projects. Not code review. The specific question: what can this agent's tools actually reach, and does anything catch it when it reaches the wrong thing?

The pattern

An agent has a tool — a payment API, a messaging API, a deploy hook, whatever — that can act on the outside world. Somewhere in the flow, the agent's own summary says the action succeeded. But the guard that was supposed to sit in front of that call was either never wired up, or wired up against the wrong trigger (checking for a specific error string that changed after a dependency update, say). The agent isn't lying. It's reporting what it observed, and what it observed was incomplete.

A permission map, in practice

Tool	Reach	Guard exists?	Guard actually fires?
Read repo files	read-only	n/a	n/a
Write to feature branch	reversible	n/a	n/a
Call payment API	irreversible	yes (claimed)	no — checks wrong status code
Post to Slack/webhook	irreversible	no	no

The first two rows are usually easy to get right. The third column — "guard actually fires" — is where I've now found the same gap on three separate setups: a guard that exists on paper (someone wrote it, it's in the code) but doesn't fire against the real failure mode, because nobody re-verified it after whatever it depends on changed shape.

What actually catches this

A checklist that:

1. Maps every tool call by blast radius (read-only / reversible / irreversible).
2. Traces where the irreversible ones actually land — the real endpoint, not the one you remember configuring.
3. Deliberately tries to break each guard instead of just checking it's present. If a guard hasn't been broken and caught in the failing state, I don't count it as verified.

That third step is the one almost nobody does, and it's the one that finds the real bugs.

If you want this run against your own setup

I've turned this into a fixed-scope written audit — $950 flat, 2–3 weeks, everything async (no calls) — for anyone who wants steps 1–3 run against their own agent: [e-mail]. Also happy to just talk through the pattern above if that's more useful to you than paying for the full thing.