Least privilege means starting from what an agent must do and granting only the tools that job requires. Both Claude Code courses apply it: subagents through their tools list, skills through allowed-tools.12 For subagents, the course gives two reasons: fewer unintended side effects, and a clearer responsibility for each subagent.1
Tools by role
| Subagent role | Course-recommended access |
|---|---|
| Research, read-only | Glob, Grep, Read |
| Code reviewer | Read tools plus Bash for commands such as git diff; no edit or write |
| Styling or code modification | Add edit and write, because modification is the job |
As described in the course.1
The /agents creation screen groups tools as read-only, edit, execution, MCP, and other. A reviewer normally needs to read, may still use execution to inspect pending changes, and should not get edit or write access.1 The chosen list is stored in the tools field of the subagent configuration file.
Rules versus guidance
Claude Code permission rules are the deterministic layer: deny blocks matching tool calls, ask requires confirmation even in Auto Mode, and allow permits them. Auto Mode’s classifier guidance (allow, soft deny, hard deny) only steers the classifier and is not enforcement.3 Broad rules that allow arbitrary code execution may still be reviewed by the classifier.3
The AI-native SDLC playbook states the same split as a principle: use deterministic checks for enforcement and agents for judgment or diagnosis.4
Beyond a single agent
- Prefer tool allowlists over wildcards; give planning and review agents read-only tools and reserve write and execution tools for implementation agents.5
- Treat adding or widening an MCP server as a reviewable, high-risk change, because it directly widens what an agent can reach.5
- Inject secrets at runtime only into the components that need them; an agent’s runtime does not automatically inherit repository CI secrets.5
- Give workflows minimal permissions by default, such as
contents: readandpull-requests: write.5 - Give automated jobs their own identity, narrow permissions, short-lived credentials, and no standing production access.4
Layers multiply
In Claude Code GitHub Actions, effective capability is the intersection of actor checks, the job’s GitHub permissions, and the tools Claude may invoke; granting a tool in one layer does nothing if another withholds it.6
Skills: allowed-tools
While a skill is active, allowed-tools limits which tools are available without asking for extra permission. A read-only onboarding skill might allow Read, Grep, Glob, and Bash and leave out editing tools. Leaving the field out keeps Claude’s normal permission model.2 Restrict tools only when the workflow needs that boundary.2
Related
- Source: The AI-Native SDLC Playbook
- Source: GitHub Certified: Agentic AI Developer
- Source: Claude Code GitHub Actions
- Source: How Claude Code Auto Mode Works
- Skill configuration: where
allowed-toolsis set. - Source: Introduction to Claude Code Agent Skills
- Delegation contract: tool limits are one of the course’s four characteristics of an effective subagent.
- Source: Introduction to Claude Code Subagents