The permissions system seems to be mostly finegrained to help you from problems that backups and sandboxes already solve.
replyThe more dangerous activities I find are sending messages to the outside world: I can't undo a dumb slack message to my boss.
That's fair, I have sent a, "Sorry claude sent that and I didn't tell him to", message before.
replyThe big problem is that in general I want slack to be able to send some messages (otherwise I would ban that). But the difference between good and bad messages is something that's hard to judge mechanically.
replyI never want Claude or any AI to post messages as myself..., if I'd wanted Claude to send a message to Slack, I'd want him to identify as Claude, or use some bot token, where it's clearly visible I'm not the one posting it (while I can still instruct Claude to say that the message was prompted by me).
replyWhy not let it delete stuff in the current working folder and in tmp, but give it read-only access elsewhere?
replyBecause I often want it to write and execute scripts in it's thinking loop in order to test assumptions or fetch data to come up with better solutions.
replyCan't it write `/tmp/test.sh` or `./test.sh` and execute it under my approach? This is what I've been doing as my status quo workflow with Codex, and I make sure I run Codex from a place where `.` happens to be a folder I'm okay with it messing up in.
reply