James Coombs is a design engineer who built a 3-layer safety architecture for AI code agents after running into 4 agent bypasses and 3 bugs in his own guards. He maintains a 60-component design system and has run controlled ablation studies on AI code generation governance.
I run Claude Code with --dangerously-skip-permissions. That flag does what it sounds like: the agent can read any file, write any file, run any shell command, and call any API. No prompts, no confirmations, no guardrails.
I do this on purpose. The default permission model ("May I read this file? May I run this test? May I execute git status?") generates 2-10 approval prompts per session depending on the work: 2-4 for a coding session (commits and pushes), 5-8 for a pipeline run that writes to Linear and creates PRs, up to 10 for MCP-heavy sessions where every write tool is individually gated. The friction isn't the count; it's the interruption. Each prompt breaks the agent's flow mid-thought. The alternative is an agent that can commit to main, force-push, send Slack messages, modify Jira tickets, and publish npm packages without asking.
So I built a third option: a safety architecture that sits between "prompt for everything" and "allow everything." The agent runs unrestricted within safe boundaries. Destructive operations are blocked before execution. When I actually want to run something blocked, I type /yes and it goes through.
