Claude Code treats CLAUDE.md as context, not enforced configuration, so a rule written there can lose to the task in front of it. Here's what does enforce one, from permission rules to a PreToolUse hook you write yourself to AgentTrail Guard, tested on a real --force-reset.
We asked Claude Code to split a column and just get the schema synced. It backed up the database, edited the schema, hit a Prisma error, and decided to wipe the database. Here's what that command would have done, and why AgentTrail Guard stopped it before it ran.
OWASP now ranks the ten critical risks of autonomous, tool-using agents. We walk ASI01 to ASI10 with concrete coding-agent scenarios, then map where AgentTrail stops the risk, where it only gives you visibility, and where it doesn't help at all.
Coding agents don't remember your team's corrections. The same deprecated API, the weakened test, the wrong logger come back every session. The fix isn't a better memory. It's catching each repeat as it recurs and enforcing it outside the model.
