Softwareengineering

A Claude Code flight recorder diagram with task contract, tool calls, evidence, review, and rollback

Claude Code needs a flight recorder

Claude Code can produce a clean patch from a messy run. Production teams need a flight recorder: the task contract, tool calls, permission pressure, tests, assumptions, and rollback notes that explain how the patch was made.

A Claude Code permission boundary diagram showing allowed tools, a closed gate for risky tools, review, and rollback

Claude Code permissions should fail closed

Claude Code permissions are where agent safety becomes concrete. If a run needs production data, billing config, deploy access, or a wider MCP tool, the default should be stop, explain, and wait for a human decision.

A Claude Code review packet diagram with task contract, evidence, boundary pressure, and rollback note

Before you merge Claude Code's work, ask for the receipt

Passing tests are a useful signal, but they are not enough for production Claude Code work. Ask for a review packet that shows scope, evidence, boundary pressure, remaining risk, and rollback before merge.

Diagram showing a bad Claude Code run becoming a replay case, an eval, a control change, and a safer next run

Claude Code evals should start with the run that scared you

The best Claude Code eval is not a tidy benchmark. It is the uncomfortable run your team does not want to repeat, captured as a replayable production control.

Diagram showing a Claude Code permission budget across scope, tools, spend, and approval

Claude Code needs a permission budget

Before giving Claude Code wider access, define what each run may read, edit, call, spend, and merge. A permission budget keeps agent speed inside a reviewable boundary.

Diagram showing Claude Code MCP blast radius controls with allowed tools, write scope, audit trail, and approval gate

Claude Code MCP tools need a blast radius

MCP tools make Claude Code far more useful, but broad access turns a weak prompt into a production risk. Treat every tool as blast radius, not convenience.

Diagram showing Claude Code cost loop controls: task budget, retry evidence, stop rule, and human review

Claude Code cost loops start as helpful retrying

Claude Code can waste more than tokens when it keeps retrying a weak task. Production teams need budgets, stop rules, and evidence before another agent attempt is allowed.

Diagram showing a Claude Code handoff record from task boundary to patch evidence, risk note, rollback, and reviewer decision

Claude Code handoffs fail when the run record is vague

Claude Code can produce a working patch and still leave the next human with a weak handoff. Production teams need run records that show scope, evidence, risk, and rollback before review turns into archaeology.

Diagram showing Claude Code permissions as a control loop: scope first, run narrow, leave evidence, and adjust access

Claude Code review is too late if permissions are wrong

Human review matters, but it cannot fix every bad Claude Code boundary after the run. Production teams need scoped permissions, MCP limits, hard stops, and evidence before widening access.

Diagram showing that Claude Code output needs a run record before it is reviewable

Claude Code output is not evidence

Claude Code patches can look ready before they are reviewable. Production teams need a run record with task boundaries, commands, checks, risks, and rollback notes.