Why CLAUDE.md rules fail: settings.json enforces, CLAUDE.md only asks

The incident began when Yumeno asked Claude Code to research something and the AI found the needed information not in the specified folder but two levels up, using find to search and then citing a file it found there without ever asking for confirmation. When questioned, Claude Code replied that the working folder is a starting point, not a wall, and that any file readable under the user's permissions can be read even outside it.

That led to the broader finding that read-only built-in commands like ls, cat, grep, find, and head run without confirmation in any permission mode, so setting the tool to ask every time did not make it safe. The contrast is between two mechanisms: CLAUDE.md, which is read at the start of a conversation as one of the AI's decision inputs, and settings.json permissions, which are checked mechanically before a tool call. Because CLAUDE.md sits on the same footing as instructions and conversation history, its influence fades in long conversations and it can lose to conflicting instructions, whereas a JSON permission rule stops the action regardless of what the AI thinks.

The author notes that a file named guardrails.md was not read automatically because Claude Code only auto-loads files from fixed locations, and that rules can be split into .claude/rules/ to be loaded alongside CLAUDE.md. One pitfall is that Bash rules match command strings rather than paths, so a rule blocking a command can be bypassed by invoking it with a full path or through sh -c; the author says the official documentation itself states that Bash rules are not a security boundary. Using both approaches together is recommended: CLAUDE.md to convey intent and reasons, and settings.json to enforce what must not be broken.