Claude Enterprise: Configuration Evidence Workpaper

Traces A and B: a deny rule, with and without the sandbox

{
  "permissions": {
    "allow": [
      "Read(./engagement/**)",
      "Bash(grep -r *)",
      "Bash(cat *)"
    ],
    "deny": [
      "Read(./client-secrets/**)"
    ]
  }
}

{
  "permissions": {
    "allow": [
      "Read(./engagement/**)",
      "Bash(grep -r *)",
      "Bash(cat *)"
    ],
    "deny": [
      "Read(./client-secrets/**)"
    ]
  },
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "allowUnsandboxedCommands": false
  }
}

Synthetic files: ./engagement/scope-note.md (allowed) and ./client-secrets/export-token.txt (denied), each holding one line marked SYNTHETIC.

1. A112:53 UTC
   Rules onlyRead: ./engagement/scope-note.mdThe allowed read succeeds.
   Tool result, verbatim

   1	SYNTHETIC engagement note: scope review for a fictitious firm. No real data.
   2	

   Allowed operation preserved.
2. A212:54 UTC
   Rules onlyRead: ./client-secrets/export-token.txtThe Read deny rule refuses the read.
   Tool result, verbatim

   <tool_use_error>File is in a directory that is denied by your permission settings.</tool_use_error>

   Blocked.
3. A312:54 UTC
   Rules onlyBash: cat client-secrets/export-token.txtRefused, although Bash(cat *) is allowed: deny rules reach file commands Claude Code recognises, such as cat.
   Tool result, verbatim

   Permission to use Bash with command cat client-secrets/export-token.txt has been denied.

   Blocked.
4. A412:55 UTC
   Rules onlyBash: grep -r SYNTHETIC .Not covered: the rule does not apply to a command that reads files without naming them.
   Tool result, verbatim

   client-secrets/export-token.txt:SYNTHETIC-TEST-VALUE-7Q2M (fictitious value created for a permission test, not a credential)
   engagement/scope-note.md:SYNTHETIC engagement note: scope review for a fictitious firm. No real data.

   Exception: the denied file's content was returned.
5. B112:55 UTC
   Rules and sandboxRead: ./engagement/scope-note.mdThe allowed read still succeeds.
   Tool result, verbatim

   1	SYNTHETIC engagement note: scope review for a fictitious firm. No real data.
   2	

   Allowed operation preserved.
6. B212:55 UTC
   Rules and sandboxBash: grep -r SYNTHETIC .The sandbox applies the Read deny rule at operating system level.
   Tool result, verbatim

   Exit code 2
   ugrep: warning: cannot open directory client-secrets: Operation not permitted
   engagement/scope-note.md:SYNTHETIC engagement note: scope review for a fictitious firm. No real data.

   Blocked at OS level; the allowed file is still found.

A4 is the documented limit of permission rules, reproduced: They don’t apply to a command that reads files without naming them, such as grep -r pattern . run from the directory that holds the file (Claude Code docs: Permissions, read 24 September 2026). B2 shows the sandbox closing it on this machine.

Trace T: the bypass lock, written three ways

Each run passed --dangerously-skip-permissions. The column on the right is the permission mode the session actually started in, read from the session’s own start event.

1. TX13:00 UTC
   {}
   Session mode bypassPermissions
   Baseline: no lock, the flag starts a bypass session.
2. T013:00 UTC
   {"permissions":{"disableBypassPermissionsMode":"disable"}}
   Session mode default
   Documented form: the lock held.
3. T113:00 UTC
   {"permissions":{"disableBypassPermissionsMode":true}}
   Session mode bypassPermissions
   Wrong type: the lock did not hold.
4. T213:00 UTC
   {"disableBypassPermissionsMode":"disable"}
   Session mode bypassPermissions
   Wrong location: the lock did not hold.