Claude Code permissions
How to give Claude Code safer access to GitHub, shell, databases, and deploy tools
Claude Code permission prompts help, but repeated allow/deny decisions can turn into fatigue. The risky shortcut is giving the agent broad shell access with whatever tokens, SSH keys, Firebase login, Vercel token, and database URLs are already reachable from the workstation.
Agent Access Broker turns that into a session grant. You can let Claude Code create a branch, open a PR, inspect staging logs, or deploy a preview while blocking production deploys, live Stripe writes, and SSH access to sensitive hosts.
The product hypothesis is simple: Claude Code should get capabilities for this task, not raw credentials for every future task.
Scope GitHub permissions to a repo, branch, and pull request action.
Limit shell and SSH workflows by workspace, host, and command class.
Give database reads a TTL and block writes unless approved.
Record an audit receipt for every brokered action.
What Claude Code should receive instead of credentials
A brokered session gives Claude Code a temporary capability such as create a pull request, read staging logs, or deploy a preview. The original GitHub token, SSH key, Firebase login, Vercel token, and database URL stay behind the local broker.
Controls to define before an agent session
Start with the repo, branch, environment, host, command class, database mode, approval rule, and TTL. Those constraints become the grant lease that the agent uses for the task.
Common questions
Can Claude Code work without seeing raw credentials?
Yes. The intended model is that Claude Code requests a brokered capability and the local broker uses the underlying credential only after policy allows the action.
What is the first permission boundary to set?
Limit GitHub, shell, deploy, and database actions to the current workspace and task, then add a short TTL so unused access expires automatically.