Unclear It is not clear whether the daemon, shell-snapshots and session-env protections are switched on by default.
Claude Code keeps its own files in a configuration directory. It now refuses to let the model write into several folders there. Each refusal is a safety check, a point where Claude Code stops a risky action, and the automatic approval system cannot override it.
jobsfolder: always protected. Theadopt.jsonfile there is handled by its own separate rule.daemonfolder anddaemon.json: protected when a server-controlled switch allows it.shell-snapshotsfolder: protected when that same switch allows it.session-envfolder: protected when that same switch allows it.
The checks also catch Windows short-name versions of these paths and temporary-file lookalikes. The refusal message explains the danger. For the jobs folder it says a file there "can give a background session more permissions or run a command without asking anyone". The messages also point the model toward another way to do the task.
Files in these folders can make background sessions or Bash commands run with more privilege than you approved. Blocking writes to them stops the model from widening its own permissions this way.
It is not clear whether the daemon, shell-snapshots and session-env protections are switched on by default.