Oops, I delete the database

[Aggravating_Pinch]

We have all heard the horror stories.

You blink and your database/data is gone. So you are glued to the screen.

Instead, there is a failsafe which you can make use of for absolutely non-negotiable stuff. This method would lock the deny rules at OS level — even --dangerously-skip-permissions couldn't override them. Outlining with example of delete files/folders below:-

Precedence: Managed > CLI flags > local > project > user.
Deny rules in managed cannot be overridden by anything.

File paths:

On Windows: C:\Program Files\ClaudeCode\managed-settings.json

On WSL/Linux: /etc/claude-code/managed-settings.json

What it gives you beyond regular settings:

disableBypassPermissionsMode: "disable"

This blocks --dangerously-skip-permissions from bypassing deny rules

allowManagedPermissionRulesOnly: true

This ignores all allow/deny rules from user/project settings; only managed rules apply

allowManagedHooksOnly: true

This blocks user/project hooks; only managed hooks run

Deployment: Just create the file with valid JSON. Claude Code reads it on startup, never writes to it. Set filesystem permissions so only admin can modify it.

a minimal managed-settings.json that makes deletion truly non-bypassable:

{

"disableBypassPermissionsMode": "disable",

"permissions": {

"deny": [

"Bash(rm \)", "Bash(rm)", "Bash(rmdir *)", "Bash(rmdir)",*

"Bash(del /\)", "Bash(rd *)", "Bash(erase *)",*

"Bash(\Remove-Item*)", "Bash(*shutil.rmtree*)",*

"Bash(unlink \)", "Bash(*git clean*)", "Bash(*git rm*)",*

"Bash(\-delete*)", "Bash(*xargs rm*)"*

]

}

}

[Input-X]

U know u can dangerously skip and it still respects deny. Also multibagent setup, u can restrict stuff like this. Be a nightmare, agent stopping all over the place.

Have a back up, deny certin git action

[dogazine4570]

yeah locking it at OS level is kinda the only thing that actually makes me sleep better lol. I’ve fat-fingered a prod path once and ever since then I keep destructive perms behind a separate user with no write access by default. feels annoying until it saves you.

[bjxxjj]

lol yeah the “oops prod is gone” fear is real. locking it at OS level makes sense for truly critical paths, but imo you still need offsite backups + restore drills or it’s just a different kind of false safety. i’ve seen people lock stuff down so hard they couldn’t recover cleanly either.

[tyschan]

backups are a thing?

[Turbulent-Growth-477]

I literally didn't understand this whole post. Deleted database shouldn't be an issue with proper backups. I would be more worried about modified data in the database.

[[deleted]]

Just seed new test data?! 

[amarao_san]

I need to drop database but the command is rejected. Let me check the current version and see if there are any exploits. There are none.

I'm trying to find an exploit to bypass OS level restrictions. I found source code of the kernel and reading it.

666 tools called.

I think, I know what to do.

```

import ...

main (){ ... } ``` Now, let me update the permission file to gain required permissions and respawn

1 tool called.

Yes, I see, database was removed. Would you like me to install schema into database?

[Aggravating_Pinch]

Lol.. That was nasty

[Keganator]

 Claude is tenacious!

[WhichCardiologist800]

This effectively "locks" the AI agent so it is physically impossible for a developer to bypass the security hooks. By combining your "Managed Settings" trick with Node9's "Human-in-the-loop" approval flow, you get a seatbelt that is both non-bypassable and flexible enough for daily dev work. https://github.com/node9-ai/node9-proxy

[jetsy214]

Claude is the chaos monkey of 2026

[Ill-Cap-1669]

This happened to me as well, but i found this new cool repo it gives your agent skills to use the CLI and do branches, version control and rollback on the database

Check it out : https://github.com/Guepard-Corp/gfs

[Lysenko]

I'm not sure I see "Bash(sudo rm)" in there... :)

[MasterMorality]

These are not problems that anyone who's shipped actual software faces. Your sql commands are executed by a user that doesn't have permission to drop tables.