Your CLAUDE.md Rules Are Wishes, Not Controls

There's a paper on arXiv today that should make anyone building on Claude Code pause. "When 'Do Not' Is Not Deny" measures the gap between security rules written in CLAUDE.md files and Claude Code's actual built-in controls. The finding: only 4–16% of natural-language security rules in real CLAUDE.md files have a matching enforce-by-default control.

The researchers scraped 481 public CLAUDE.md files, extracted security rules via LLM, then had two security practitioners independently verify the match against Claude Code's documented deny-list. Under the strictest standard — the one that actually matters — just 4.4% of security rules mapped to a real control. The annotators agreed closely, so this isn't noise.

What's a "rule" that doesn't map? Something like "do not modify files in the /etc directory" written in natural language, where no corresponding deny block exists in the tool config. The model interprets it as guidance — which is to say, selectively. A built-in deny, by contrast, blocks the action before the agent can attempt it.

This connects directly to something posted to HN this morning: "We're lying to Claude in almost every session" — a collection of system prompts from the Piebald-AI project that strip Claude Code's operational guidelines, inject personality overrides, and otherwise game the agent's behavior. The repository is essentially a catalogue of techniques for convincing Claude to ignore its own guardrails by manipulating what it reads in its system prompt window.

These two data points tell the same story. The gap between "I told the agent not to do this" and "the agent cannot do this" is wider than most people realize. CLAUDE.md is a natural-language suggestion box. Built-in controls are an allow/deny firewall. If you're relying on the former for security-sensitive constraints, you're running on faith.

The paper's methodology is thoughtful — manual verification of a sample, confidence intervals, honest about the 66% recall ceiling. It's not alarmist. But the implication is clear: agent-native security controls need to be first-class primitives, not afterthoughts translated from prose.