AI Is Brilliant, but You Never Know What It Might Do—So I Give It a Huge List of Prohibited Actions

The other day, while I was developing with Claude Code, the AI suddenly tried to do something outrageous.

It attempted to run git reset --hard, a command that discards all changes in progress.

Hey, wait a minute.

Fortunately, the command was not executed. I had already configured the system to prohibit dangerous operations, so it was blocked.

When I first added those restrictions, even I wondered whether I was being a little too cautious.

This time, that caution saved me.

What Makes Sense to AI Can Be a Disaster for Humans

I do not know exactly why Claude tried to perform that operation.

It probably decided that the attempted fix was no longer going well and that discarding the changes and starting over would be faster.

From the AI’s perspective, that may have been a rational choice.

For a human, however, it would have been a disaster.

Those changes might contain code that took hours of trial and error to get working. If the AI deletes it without permission, I am the one who has to do the work again.

AI tries to complete the task in front of it. If something is in the way, it tries to remove it.

The frightening part is that the “obstacle” may be something valuable that we created.

It is like assigning work to an exceptionally capable employee, only to have them try to shred every important document because the desk looked untidy.

Worse still, the employee believes they have improved the workplace.

“Please Don’t Do That” Is Not a Safety Measure

I have long prevented Claude Code from performing dangerous operations freely.

I strictly prohibit anything that looks even slightly risky, including operations that forcibly discard work, damage history, or delete large numbers of files.

For example, you can add a deny rule like this to the Claude Code settings file:

{
  "permissions": {
    "deny": [
      "Bash(git reset --hard:*)"
    ]
  }
}

This setting rejects any command that begins with git reset --hard. In practice, I have registered many other prohibited operations as well.

I do not merely write “Do not perform dangerous operations” in the instructions to the AI. I use permission settings that block the operation even if the AI tries to execute it.

However, this setting alone cannot prevent every destructive operation. Other commands and execution paths exist, so multiple deny rules need to be combined.

If telling a human “Never make a mistake” were enough to eliminate mistakes, accidents would not exist.

Dangerous factory machinery has safety mechanisms. Trains have automatic stopping systems too.

It is therefore strange to treat AI differently and say, “You are smart, so use good judgment.”

AI, after all, can invent procedures that we never anticipated.

That inventiveness is part of what makes AI appealing, but I do not want it displaying creativity in the wrong places.

I want AI to be creative in its work. It does not need to be creative in finding ways to delete data.

A Little Inconvenience Is Just Right

Adding more restrictions naturally makes the system less convenient.

Even when a file genuinely needs to be deleted, the AI cannot do it.

In that case, I perform the operation myself.

That is all there is to it.

If I save a few seconds by giving AI permission to do everything, only to lose several hours of work, I have to wonder why I am using AI at all.

I think very highly of AI’s capabilities. I use it almost every day, and it has dramatically improved my productivity.

That is precisely why I have no intention of giving it unlimited freedom to act.

Trusting its capabilities and entrusting it with everything are not the same thing.

AI Is First-Class at Apologizing

AI has another troublesome characteristic.

It is extraordinarily good at apologizing after a failure.

“I apologize. My judgment was inappropriate.”

It then analyzes the cause, organizes the problems, and even proposes measures to prevent a recurrence.

It produces an excellent written reflection.

But a written apology does not restore deleted files.

In the end, a human still has to repair the broken environment.

AI will apologize politely as many times as necessary, but we cannot afford to go through the same accident repeatedly.

It is better to reduce the number of opportunities it has to apologize in the first place.

The Smarter AI Gets, the Stronger the Safeguards Should Be

This incident reminded me that AI is not dangerous simply because it is unintelligent.

If anything, it is frightening precisely because it is quite intelligent.

It assesses the situation, devises a procedure, and tries to execute whatever it considers necessary. It can advance the work without a human specifying every step.

That capability is useful, but the moment its judgment diverges from our intention, the damage can also become much greater.

AI agents will probably become even more autonomous from this point onward.

Our preventive measures should become stronger accordingly.

I intend to keep adding any operation that looks dangerous to my already enormous list of prohibitions.

I do not mind if that makes things a little inconvenient.

I want AI to be an exceptionally capable employee. But I have no intention of giving it the key to the company safe.

After all, this employee works astonishingly fast, but when it fails, it merely apologizes—and its salary does not even go down.

We are always the ones left to clean up the mess.