Maybe a dumb question, but can't you put into CLAUDE.md something like this?

"When an action fails with an 'access denied' or 'insufficient permission' error, report the error to the user and immediately stop. Do not try to find a fix or workaround for the error. Do not try any alternative approaches."

I wasn't using Claude Code, but I told an agent to add something like this to the AGENTS.md, it did it and then a few minutes later it attempted to grant itself permission to do something and managed to delete the VM it was running on in the process. I have since adjusted the way I sandbox agents to make that less likely, but the moral of the story is clear.

Once the session gets long enough, agents start getting amnesia.

Replacing docker with podman could help in this particular case. Running everything in an insulated throwaway VM should help even better.

Unless you trust an AI as much as you trust yourself, there's no reason to allow it to act with your privileges.

it's a probabilistic model so, while you can put that in there, it has some probability of just ignoring you and doing it anyway.