Bypass mode, safely

Bypass skips every prompt. It's how long jobs run unattended, and it's how one wrong delete can wipe files in a bad afternoon. A folder plus deny rules does not contain it. Deny rules are permissions: Claude's own harness choosing to obey them. In bypass, Claude can run any command your account can, anywhere on the machine. Containment is isolation: the operating system stops the process, whatever it tries. It comes in grades, from weakest to strongest: a restricted shell, a container, a virtual machine. The rule: bypass only inside a disposable container or virtual machine that holds copies of files and no credentials, and only after you've tested that it holds. Without one, don't use bypass; pre-approve the exact commands the job needs with allow rules instead. A buyer's contact list is not the place to hand over the keys.