Claude's insistence on protecting me from myself has already caused me enough frustration that I'm lowering my subscription tier and exploring if other models will work for me instead. The agents work in a VM I've set aside for them or in the cloud, the code & assets are backed up and in source control, and I don't care if the VM gets entirely destroyed because I can rebuild it. I've written this down for the agents. And yet the classifier keeps blocking agents from doing innocuous things like cloning an additional repo on-demand.

Having a "EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS" flag is exactly what I'd use. Maybe Anthropic saw the constant profanity in the prompts I've been sending after getting refused.

I see no inherent problem with that, since it's a very good idea to run agent inside container/VM anyway. And if the only things agent can access is the docker container and /project directory? It can go wild inside.

The variable alone, however, is kinda suspicious - I'd do both variable and command-line flag, just for extra assurance.

(another idea might be to enforce docker, but I know some people run agents in VMs, so this won't work)