A 34-chapter Claude Code operations handbook argues only two of four control layers are enforced.

Four propositions, and the second is the one I'd print out. Instruction, permission enforcement, sandboxing and OS isolation are four distinct layers, only two are enforced, and conflating them is the most common cause of losing control. The others: capability without a defined observable completion condition is not productivity; third-party skills, plugins, marketplaces and MCP servers are supply-chain dependencies; and the correct unit of trust is observed evidence, not the agent's closing statement. Every product claim carries a primary-source citation, unconfirmable claims are labeled UNVERIFIED, and controls map to seventeen external frameworks. That citation discipline is rarer than the content. (arXiv)