Claude Code v2.1.248 added `--restricted`, a single-flag hard sandbox that ignores every settings file.

--restricted or CLAUDE_CODE_RESTRICTED=1 removes the built-in tools that run commands or code plus WebFetch unless explicitly named in --tools, confines file tools to the working directory, refuses bypassPermissions, and ignores user, project and local settings files entirely (GitHub). For unattended agents this is the first mode that doesn't depend on getting a permissions config right, which the Rehberger chain and the IPE paper both argue you will not do.