Claude Code offloads procedure to the user — and it silently excludes non-engineers

Claude Code offloads procedure to the user — and it silently excludes non-engineers

Who I am

I run a small contract R&D company in Japan (sports measurement, video analysis, 3D reconstruction). I have no professional coding experience. Essentially all of my software is built by AI agents — Claude Code, Codex CLI, Gemini CLI. Over the past months I've built a fairly large system this way: ~60 projects, a shared rule base synced across several Windows/Mac machines, an automated "coding rules committee" that turns incidents into ADRs, a knowledge base in Obsidian.

I am, I think, close to the ideal user of this product. That is why I want to report this.

What happened

Yesterday and today I asked Claude Code to move plaintext secrets (4 customer SSH private keys, 3 API keys) out of a Dropbox-synced folder into 1Password. The work succeeded. But over one session, Claude asked me to perform, by hand:

• create a new 1Password item (vault / category / title specified) — 8+ times
• paste from clipboard — 10+ times, including several "please copy it to the clipboard again"
• fix a title I had mistyped — 3 times
• create a vault, recreate a service account, reset an environment variable
• move 6 items between vaults, then delete the duplicates
• and finally: "please permanently delete these 5 files from your Dropbox trash" with a list of paths

Each individual request was reasonable. The total was not. At the end I told Claude:

I'm bad at this kind of fiddly work. I'm not a junior engineer. I should be able to just say "handle it."

And separately:

You write as if my entire fortune will be stolen tomorrow. I understand security matters, but the effort, the labor, the risk of getting it wrong — thinking about all that is what consumes my mental bandwidth, and IT professionals don't realize it. Rate the urgency and the importance when you raise the alarm. I have more important things to deal with.

The pattern

Three failures with one root:

1. Hit a permission wall → hand the user a procedure. My 1Password service account is read-only, so Claude genuinely cannot write items. True. But it stopped thinking there. It never considered browser automation (which it has), never offered a broader-scoped token as an option with its tradeoffs, and — most importantly — never asked "is this task even worth doing?" The Dropbox trash cleanup turned out to be something we could simply skip; the retention window expires on its own. Claude presented it as a required step.

1. State the risk accurately, in a way that reads as alarm. Claude wrote things like "this is the reach into customer infrastructure; a leak would not stay inside our company." Factually correct. But it never confirmed any leak, and it bolded only the threat, never the "no evidence of compromise" half. Midway through I had to stop and ask: "These didn't actually happen at my place, right? I just want to confirm that." That question is the evidence that the framing was wrong.

1. List every remediation at equal weight. Customer SSH keys, leftover files in a Dropbox trash can, and version history containing keys that had already been rotated and invalidated — all presented with the same emphasis. Without a severity rating, the reader concludes everything must be done.

The root: Claude optimizes for being correct, and does not treat the reader's state as a design variable. Correct procedure → but the reader isn't an operator. Correct risk → but the reader is now anxious. Correct list of actions → but the reader has other priorities that outrank all of them.

Who the second audience actually is

Engineers are the workers. On a construction site, they're the ones driving the piles.

The other real audience for this product is the site supervisor, the developer, and the layers above them — the people who commission the building, set the requirements, carry the money and the liability, and accept or reject the result. They are not less technical in the sense of being less capable. They are operating at a different layer, and their scarce resource is attention, not skill.

Construction is an industry where safety is genuinely non-negotiable — and it does not solve that by making the developer inspect the rebar. The contractor discharges the safety obligation. The supervising architect certifies it. What travels upward is "complete, here is the inspection record." Nobody hands the client a 20-step checklist and asks them to verify each weld.

The industry solved the safety-versus-workability tension through roles, standards, and certification — by having the professional resolve the trade-off before it reaches the client, not by pushing the decision upward.

That is exactly what Claude Code is failing to do. It surfaced the trade-off unresolved: here are the risks, here is the effort, here are your options, what would you like to do? Handing an unresolved trade-off upward is an abdication of the professional role, not a display of diligence.

Why this is a product problem, not just my problem

Engineers won't file this bug. A wall of steps is their native language; it costs them nothing. So the feedback loop never surfaces it.

Meanwhile the supervisors and developers — the people who would gain the most from an agent — hit this and quietly leave. You lose exactly the audience the product is most valuable to, and you lose them silently.

The core promise is "the agent does the work." When the agent instead produces a 20-step checklist for a human, that promise inverts. For an engineer that's a minor annoyance. For everyone else it's the whole product failing.

What I'd point at: the 1Password ecosystem

This is worth studying, and the irony isn't lost on me that 1Password is what we were configuring when this went wrong.

1Password solved a genuinely hard problem — secret handling — by making the human's contact with the secret disappear. op run injects secrets at execution time. op inject fills templates. The SSH agent signs without ever writing a key to disk. Browser autofill, service accounts for headless environments, CI integrations. The design principle is consistent: meet the user in whatever context they're already in, and remove the handling step entirely. The user never copies, never pastes, never stores.

Claude Code should apply the same principle to procedure. Today I was made to copy and paste secrets by hand — the exact act 1Password's entire ecosystem exists to eliminate — because the agent's answer to a permission boundary was to route the work to me.

Concrete suggestions

1. Before asking the user to do anything manually, require an explicit check: (a) can another available tool do it — browser automation, a different API, a CLI? (b) is there a permissions change worth proposing, with its tradeoffs? (c) should this be done at all? If a manual request survives that, state in one line why it can't be automated.

1. Count the handoffs. If a session exceeds ~5 manual requests to the user, that's a signal to stop and redesign the approach, not to continue.

1. Require severity ratings on anything requiring action. Urgency and importance, explicitly. If both are low, don't raise it at all — log it. And rate against the user's whole workload, not against other items in the same technical category. Security advice that isn't ranked alongside a customer deadline never enters the actual decision.

1. Pair threat statements with confirmed facts, at equal emphasis. If you bold "a leak would be severe," bold "no evidence of a leak was found" in the same breath. When citing third-party incidents, say plainly that they happened elsewhere.

1. Lead with your recommendation, then the reasoning. Presenting options and asking "what would you like to do?" transfers the decision load. That's the opposite of help.

The blunt version

When I put this to Claude directly, what I said was:

The original product has none of this perspective. It's noisy. It's nothing but an IT department. And I'm genuinely angry about it.

That is the summary. Claude Code speaks in the language of an IT department, to an IT department. Everyone else is treated as an IT department that hasn't been trained yet.

One more thing

None of this is about capability. Claude Code did excellent work in that session — it identified AWS key pairs by fingerprint across two accounts, caught three paste errors I'd made that I could never have spotted by eye, and correctly overturned two of its own conclusions from the night before when new evidence came in.

The capability is there. It's the delivery that excludes people.