What
In a restricted session the permission checker skips the usual implicit allowances (workflow script files, agent memory .md files, .claude/launch.json, and "project directory files are allowed for reading"), and a denial from a safety check can no longer be rescued by the automatic approval classifier.
Details
- Safety-check denials are returned as not classifier-approvable, tagged with a dedicated circuit breaker that is registered as immune to bypass and never routed to the classifier.
- The relaxations that remote mode normally applies are suppressed when the session is restricted.
- Only reachable when the session was started with
--restrictedorCLAUDE_CODE_RESTRICTED.
Evidence
{ classifierApprovable: !1, circuitBreaker: "restrictedMode" }, circuitBreaker: "restrictedMode", restrictedMode: { bypassImmune: !0, classifierRouted: !1 }
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundle--restrictedCLAUDE_CODE_RESTRICTED
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up --restricted, on Tools reference.
* A permissions [deny rule](/docs/en/permissions#match-all-uses-of-a-tool), the `--disallowedTools` flag, or [`--restricted`](/docs/en/cli-reference#cli-flags) removes `Bash` from the session.tools-reference see the edit
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up --restricted, on Tools reference.
Anthropic's release notes agree
Added --restricted (or CLAUDE_CODE_RESTRICTED=1): removes the built-in tools that run commands or code and WebFetch (unless named in…
The name it cites is new in this build
New in this build: --restricted