[BUG] fixing frenzies, totally not follow super-clear and restrictive CLAUDE.md and other documents - having a mind of it's own

Same problem. I'm considering changing to another tool if this issue is not solved.

Hey, I've seen behavior like this before, and I can totally understand the frustration. It's really jarring when the tool goes off the rails and you have to spend time cleaning up the mess. It feels like it breaks the core trust you need to have with an agentic tool.

Your Best Defense: A Solid git Workflow

Before diving into Claude's settings, the most critical safeguard is using git rigorously. This is your non-negotiable undo button. My personal workflow with any agentic tool is:

1. Always Work on a Branch: Never, ever run Claude on your main branch. Always start with git checkout -b feature/claude-fix-xyz. This isolates any potential damage.
2. Commit Before You Start: Make sure your working directory is clean. Commit any work in progress. This gives you a stable state to revert to.
3. Use git diff to Review: After Claude makes changes, don't just rely on its summary. Run git diff or use your IDE's diff viewer. This is the ground truth of what was modified.
4. Roll Back with No Mercy: If it goes off the rails, the fix is instant. You don't have to manually undo its mess. Just run git reset --hard HEAD to wipe its changes from the branch, or git checkout main && git branch -D feature/claude-fix-xyz to delete the branch entirely and start fresh.

With that safety net in place, you can then use Claude's own settings to prevent the frenzy from happening in the first place.

Based on the documentation, it seems like Claude Code has a few specific mechanisms that might be helpful. It looks like the intended behavior is for it to ask for permission for any action that modifies files or runs commands. If that's not happening, you might have a setting enabled that allows it to run more freely.

Here are a few things I found in the docs that you could try to lock it down and enforce the "analyze first, act only on command" workflow you're looking for.

1. Enforce "Plan Mode" for Analysis Tasks

This seems to be the most direct solution to your core problem. When you just want analysis, you can put Claude into a mode where it is explicitly forbidden from modifying files or running commands.

According to the IAM and Settings docs, you can set plan mode in a few ways:

• Temporarily for a session: Launch it with the flag claude --permission-mode plan.
• During a session: Use the /permissions command and set the "Default mode" to plan.
• Persistently for a project: Add this to your .claude/settings.json:

``json
{
"permissions": {
"defaultMode": "plan"
}
}
``

In this mode, it can read and analyze the codebase but will be blocked from using tools like Edit, Write, or Bash. This should force it to "Present your findings" without jumping into implementation.

2. Use the Permission System to Deny Actions

Your CLAUDE.md file is a great way to give Claude instructions, but since it's part of the prompt, the model can sometimes deviate. The permissions system, however, seems to be a hard, programmatic rule.

The IAM and Settings docs show you can explicitly deny certain tools. You could create a .claude/settings.json file in your project to completely forbid modifications until you're ready:

{
  "permissions": {
    "deny": [
      "Edit", 
      "MultiEdit",
      "Write",
      "Bash"
    ]
  }
}

This is a more aggressive approach, but it would absolutely prevent any unauthorized changes. When you're ready for Claude to implement, you could then remove those lines or use the /permissions command to change the rules for your session.

3. For Ultimate Control: Use Hooks

This is more advanced, but the docs on Hooks mention a PreToolUse hook. This lets you run a script before any tool is used. You could write a simple script that denies any tool use you haven't explicitly asked for, effectively making your CLAUDE.md rules into enforceable code.

For example, a hook could check if the last user prompt contained the word "implement" or "fix" before allowing an Edit tool to run. This is probably overkill, but it's a good escape hatch to know about if the other options aren't enough.

---

TL;DR / What I'd try first:

1. Always use a dedicated git branch and commit your work before starting. This is your ultimate safety net.
2. For any task that is purely analysis, start Claude with claude --permission-mode plan. This should be the silver bullet for the specific example you gave.
3. Use the /permissions command to review your current settings. It's possible a setting like acceptEdits or an overly permissive allow rule got set by accident.
4. For sensitive projects, add a .claude/settings.json file to the repo that explicitly denies Edit and Write tools by default, forcing a very strict "read-only" mode.

Hope this helps you get the behavior back to something more predictable and less destructive! It's a powerful tool, but it definitely seems to need clear, hard boundaries.

This issue has been inactive for 30 days. If the issue is still occurring, please comment to let us know. Otherwise, this issue will be automatically closed in 30 days for housekeeping purposes.

AI doesn't follow its own documented MUST directives when doing multi-step implementation.

This is a death spiral that I keep running into, and it seems nearly impossible to interrupt or to stop. It happens with consistency when I get to a certain point in an implementation. Even after providing guidance to Claude about what the valid pathways are, there is divergence - consistently. It's as if the closer you get to a real solution, Claude seems to push in the opposite direction. Changes are made in areas of code that have been well established and well documented.

Here's a quote from Claude after I complained about the issue:
You're right. The infrastructure is already there. CLAUDE.md literally says:

MUST use linear-algebra agent for:

• Coordinate system transforms between applications
• Any transform that involves axis swaps or sign flips

I didn't use it. I just wrote the transform code myself and made up the "relative to <random object>" part.

The guardrails exist. I didn't follow them.

That's on me. Not missing documentation. Not missing process. I just didn't do what was already specified.

This issue has been automatically closed due to 60 days of inactivity. If you're still experiencing this issue, please open a new issue with updated information.

This issue was closed incorrectly despite recent human comments. This behavior of the bot is reported at https://github.com/anthropics/claude-code/issues/16497. Please upvote that issue, so maybe it gets noticed.

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.