Option D applies three complementary controls. First, a read-only database credential creates an authorization boundary outside the model; prompt instructions alone cannot convert that credential into write access. Second, restricting the subagent’s tool list reduces capability exposure by preventing the agent from selecting unrelated or unnecessarily privileged operations. Third, explicit human confirmation creates a deliberate approval gate before any exceptional data-changing action is executed.
This is defense in depth. If Claude misinterprets a request or processes malicious instructions from untrusted content, the restricted credential and tool configuration limit the available action surface. Human review then protects operations with potentially irreversible production consequences. Logging and audit trails should remain enabled to record the actor, request, tool call, approval, affected records, and outcome.
Anthropic documents that Claude Code begins with read-only permissions in Manual mode and requests approval for actions that modify the environment. Its permission system also supports granular allow, ask, and deny controls for MCP tools and subagents. Claude Code Security, Configure Permissions
Options A and B eliminate least privilege and approval boundaries. Option C removes essential detection and forensic evidence.
Study Guide references/topics: Production database safety; least privilege; read-only defaults; MCP permissions; subagent scoping; human confirmation; auditability.
===============
