Handbook argues Claude Code enforces only 2 of 4 control layers

A new operations handbook for Claude Code lays out four control layers teams assume are all active at once: instructions, permission enforcement, sandboxing, and OS-level isolation. Per the paper, only two of those four are actually enforced in a typical setup, and treating the other two as if they were is the most common way teams lose control of an agent run.

That matters because Claude Code now runs with filesystem access, shell commands, a browser, scheduled jobs, cloud execution, MCP connections, and multi-agent orchestration all in play at once. An instruction telling an agent not to touch production data is not a technical control. A permission prompt is. The handbook's point is that most incident reports blur that line, treating a policy an agent was told to follow as if it were a wall the agent physically could not cross.

The paper's other three propositions build on the same idea. Capability without a defined, observable way to check for completion isn't productivity, it's motion you can't verify. Third-party skills, plugins, marketplace extensions, and MCP servers are supply-chain dependencies, not features, because each one can execute code with the agent's own permissions. And the unit of trust should be observed evidence of what the agent actually did, never the agent's own closing summary of what it did.

The handbook backs every product claim with a primary-source citation and labels anything it couldn't confirm as UNVERIFIED, then maps its recommended controls against seventeen external security frameworks. That's a higher bar than most agent-safety writing clears, and it's also why the four-layer framing is worth taking seriously instead of filing under general caution.

For builders running agents against real filesystems or cloud accounts, the practical test is simple: can you point to a log line the agent didn't write itself proving a specific action happened, or are you trusting its last message? If it's the second one, you have an instruction, not a control.