Working inside your service folder, you approve several file edits and a build command. Later Claude needs to touch a file in the parent directory and stops to ask. A colleague says the earlier approvals should have covered it. What is the flaw in that reasoning?

The principle — two different things are being confused: what an action is allowed to do, and where actions are allowed to happen at all.

Why the key is correct — Anthropic draws the second line explicitly. Claude Code can only write to the folder where it was started and its subfolders, and cannot modify files in parent directories without explicit permission. That boundary is a property of the session, fixed when you launched it, and it is not built up from the approvals you grant during the session. Each approval you gave authorised a particular edit or a particular command; none of them moved the perimeter outward. So the prompt on the parent directory is the system behaving exactly as documented, and it will keep appearing however many times you say yes inside the project. Anthropic also places the responsibility clearly: Claude Code only has the permissions you grant it, and reviewing proposed code and commands for safety before approval is yours.

Why the others are wrong — treating accumulation as the rule and the prompt as a bug is the belief that leads people to reach for a blanket override, which is the worst available response to a working safeguard. Taking your user account as the boundary would make the boundary meaningless, since your account can usually write almost anywhere. And reading earlier prompts as safety certificates inverts what they are: a prompt is where a decision is handed to you, and a decision about one file inside the project carries no information about a different file outside it.

Remember this — if you genuinely need to work a level up, restart the session a level up, and understand that you have moved the perimeter rather than earned an exception.

Sources — Anthropic's Claude Code security page.