The last post explained the two fences your computer can enforce for you: a sandbox that confines the commands Claude Code runs, and a set of permission rules that confine its own “hands” — the built-in tools Claude Code uses to open and change files directly. Knowing you want both is the hard part. Getting them in place is easier than you might think.
The sandbox and permission rules live in a hidden settings file on your computer, in a folder called ~/.claude that, by design, sits outside the folder on your computer that I hope you’ve already made for your work with Claude Code (that “AI Workspace” folder I described how to set up in Part 1 of “Unknown Unknown #1”). The good news is that the hidden settings file is located in a corner of your computer you would never open by accident. Claude Code cannot change that settings file itself: when I was working on setting these fences up on my own computer, Claude Code actually did try to edit its own permissions. Fortunately, my computer’s system refused it, on purpose. That’s how you protect yourself: by writing the rules to constrain Claude Code, and then installing them somewhere it can’t rewrite.
Now here comes the part that might feel a little dangerous. Since I’m not a coder, I had to ask Claude Code to write that settings file for me. Probably you’re going to need to do that too. It means describing, in plain words, what you want fenced. And then Claude Code gives you the computer code you need to install to set those fences up. You have to install that code on your computer yourself, because the whole point is that Claude Code is not allowed to get into the settings file. Here’s how to do it, start to finish.
- Ask Claude Code to write the rules. With Claude Code running inside your AIWorkspace folder, give it a request like the one below. In this example, I’ve listed out the specific folders I want to keep Claude Code out of — Documents, Desktop, Downloads, cloud folders — as well as some additional files I don’t want it to touch. Your list of prohibited places might look different. Copy the below text, but remember to swap in your own folder names for the places you don’t want Claude Code to go:
“I want to fence you in so you can only work inside my AIWorkspace folder. Please set up both of the enforced fences we need: the sandbox that limits the commands you run, and the permission rules that limit which files you can open. Together they should confine you to my AIWorkspace folder and block your access to my Documents, Desktop, and Downloads; my cloud folders (Box and Dropbox); my saved passwords and keys; and the transcripts of my past sessions. Tell me which file the settings go in, explain in plain language what each part does, and remember that you can’t install it yourself. I’ll paste it in.”
- Have Claude Code hand you the finished code, along with clear instructions on how to install it on your computer. Once you’ve got the above code produced, ask Claude Code to give you the exact, click-by-click way to put the settings into place on your particular Mac. The details differ from machine to machine, and Claude Code can check yours and get them right — better than I can specify in a post that cannot see your computer. Yes, there is some trust going on here. If it makes you nervous, maybe you can ask a person who knows how to code to sit with you while you do this. But take it from me: it’s pretty straightforward to do.
- Paste the settings in and save. Follow those steps to open the settings file Claude Code named — it lives in a hidden folder called
~/.claude— and paste in the exact code that Claude Code wrote. Then save it. If opening a hidden file is unfamiliar, you can ask Claude Code how to do it as part of your request for step-by-step instructions. That’s what I did. - Quit Claude Code and start it again. The new rules you’ve just given Claude Code will only be read once it starts up again. They do not take effect until you restart Claude Code, so don’t forget this step.
- Before you point Claude Code at anything sensitive, run a check. Don’t skip this step! It’s how you confirm you did your setup correctly. A first-time setup happens before the fence exists, so until you have confirmed the fence is up, treat Claude Code as if it were unfenced and keep it away from any real data. The next section is a one-minute check that confirms the fence holds. Run it, and test the specific places you most want kept out.
None of the steps above asks you to write a line of code yourself. It does ask you to describe what you want, move a file into place, and check the result. If you would rather not touch even that much, you can hand the whole task to your institution’s IT office; a clear request sounds like this: “Please set up my AI assistant so that it can reach only one folder, and show me how to check that it’s working.” Either way, the judgment is the part that stays yours — deciding what to fence, and confirming afterward that it holds.
Check the fence
Whatever fences you have, you should be able to check them, and the check takes about a minute. You do not need to understand the commands involved; you only need to read the result. Ask Claude Code, in plain words, to do two things.
First, ask it to open a folder that should be off-limits. The correct answer is a refusal: “Operation not permitted,” or “denied by your permission settings,” or words to that effect. Then ask Claude Code to open your workspace folder. The correct answer is that it simply works.
I ran exactly this check while finishing this post. I asked Claude Code to open my Documents folder, my hidden login file, and the transcripts of my own past sessions; each time it refused. I asked it to open my AIWorkspace folder; it did. If the forbidden folder is refused and the workspace folder opens, your fence is up. If a folder you meant to keep out is opened for you instead, then whatever you believed about your fence is wrong — and that is the moment to stop and sort it out, before you do anything sensitive. You can tell Claude Code what happened, and ask it to help you fix it.
The next part of the check runs in the other direction: ask Claude Code what is permitted, not only what is refused. Claude Code can answer that question about itself. It cannot open the settings file — those rules are deliberately placed where it cannot reach them — but it can see the rules in force in the session it is running in, and it will list them if you ask:
Using the permission and sandbox rules in force in this session, list every location outside my AIWorkspace folder that you are allowed to read or write, including anything allowed by an exception, and every address on the internet you are allowed to reach. For each one, tell me what it is for. I want to decide whether I want it there.
It’s important to ask about internet addresses as well as folders on your computer. When I first ran this check, my list of approved internet sites had roughly 480 addresses, nearly all of them places from which Claude Code had fetched information while working on a project for me: journal publishers, databases, government websites, preprint servers, etc. Read what comes back as a list of decisions you are being asked to ratify. Anything you did not choose, or cannot see a reason for, is the thing to take out.
The takeaway
Here’s your checklist for putting your fences in place:
- Ask Claude Code to write the settings that fence it to your one folder and deny the sensitive places by name.
- Install them yourself — paste the file in and restart — or hand that one step to a colleague or your IT office. It is done once.
- Before you let it near any real data, run the one-minute check: ask it to open a folder it should not reach, and confirm it cannot.
- Ask the other question too: what are you allowed to reach outside this folder — on my computer and on the internet — and why? Run that once now, and again whenever the rules change; a refusal test finds only the holes you already guessed.
The setup shouldn’t take too long, maybe an hour or so. If you’re feeling nervous about doing it yourself, try an email to your IT office, which should be able to help you (you can share this post with them, too!). And you probably want to re-read your rules occasionally — a fence you installed once and stopped checking is one you are trusting, not one you know.
Next: before you enter a single file, the prior question — what you owe the people whose data you hold, once an AI assistant can reach it.