Unattended AI should fail closed: centralize config, log denials
Unattended agents should not hang waiting for a human; centralize config, deny unresolved prompts, and log those denials as pipeline results.
| By | Prompt & Product — Newsroom |
|---|---|
| Filed | 15 September 2026 |
| Read | 3 MIN |
A CI job can stall while the agent waits for a human. Before Claude Code v2.1.259, an unanswered permission request in an unattended print-mode run sat until an external job timeout or CI step limit killed the process. The job should stop the action, record the refusal, and let the pipeline decide.
Anthropic published Claude Code versions 2.1.259, 2.1.260, 2.1.261, and 2.1.263 on 2, 3, 4, and 6 September 2026, with 2.1.263 published at 02:07 UTC. The pattern is fail-closed permissions: the boundary decides before the model asks for a person.
Google's Secure AI Framework sets an agent-permissions standard: minimal necessary privileges, dynamic permission scoping, and explicit user control for sensitive actions. OWASP's emerging agentic-application guidance says limit AI capabilities at the system boundary instead of relying on prose.
Rollout rule: centralize server config first, then add the deny-backstop; log denials as pipeline results, not hangs.
Centralize the boundary before you ship the agent
Inventory the tools the agent can call, and mark each one as read-only, write, or secret-bearing. The finished state is a table your team can review in a pull request, with the owner named for each row.
Move shared endpoints into the centralized setting. Claude Code's managedMcpServers setting allows a central administrator to define HTTP and SSE MCP server connections, the tool endpoints, for all runners rather than requiring local configuration on each runner. A runner that starts with no local tool config and still reaches the same approved servers is the target.
Review the config in the same pull request that changes the agent. A reviewer should see the new tool, the owner, and the denial path before the job runs.
Deny unresolved prompts immediately
Set the deny flag in the unattended job. The v2.1.259 release introduced a --permission-prompts none setting that rejects unresolved human-approval requests at once and instructs Claude to stop retrying them.
Keep the human approval path for attended runs. The unattended path should be the one that cannot wait.
Test the deny path with a harmless action that requires approval. A local run should show the refusal before the production job does.
The warning is easy to miss: a denial list can look like noise, and the tempting response is to widen permissions. That turns a logged boundary into a silent hole.
Log the denial as a pipeline result
Write the denial into the job log. When --output-format stream-json is used, denials caused by --permission-prompts none appear as permission_denied system messages and are included in the final result's permission_denials field.
Make the pipeline fail when the denial field is nonempty. A denial is a result, so it should get the same treatment as a failed test or a lint error.
Keep the denial record for at least the same retention window as the build artifact. A postmortem should find the exact refusal without asking the model to remember.
That record becomes the agent release checklist item: no headless agent deployment ships until the denial path is visible, actionable, and owned.
Make the denial useful, not just visible
Trim the context after the deny path works. Claude Code 2.1.261 added the /skill-doctor command, which lists skills that are not being used and shows the context cost associated with each.
Check the cache before you blame the model. Claude Code 2.1.260 made the reasons for prompt-cache misses visible in the /cost command and in the status line.
GitHub Actions workflows using the pull_request_target trigger, a setting most AI agent integrations need to access secrets, place secrets into the runner environment. During the Comment and Control exploit, the AI agent obtained an API key from the runner environment variable, encoded it inside a pull request comment, and sent it via GitHub's API. Removing bash access from the code-review agent would have blocked the entire attack chain.
Anthropic's Opus 4.7 system card says Claude Code Security Review lacks hardening against prompt injection. Addy Osmani's June 7, 2026 loop-engineering essay says the code-generating model is capable, while poorly designed agent loops fail at the verifier. Review the denial path before you review the model's output.
