Blast-Radius Engineering in Claude Code: Bounding What an Unattended Run Can Touch with IAM, OIDC, and Branch Protection

A two-part episode for people running Claude Code unattended.

News. Anthropic shelved the planned Agent SDK and claude -p billing split on June 15, the day it was due to land, telling customers "nothing changes for now" and promising a reworked plan with advance notice (The New Stack, digitalapplied, the-decoder). Headless and SDK usage keep drawing from your subscription pool, so don't migrate automation to API keys for this reason. v2.1.178 adds Tool(param:value) permission rules (e.g. Agent(model:opus)), nested .claude/skills auto-load, and runs subagent spawns through the auto-mode classifier (changelog, release). v2.1.179 is fixes only: mid-stream drop recovery, WSL2 scroll restore, and a sandbox glob fix on Linux. Backdrop: short outages and elevated Opus 4.8 errors (StatusGator, TechTimes).

Tutorial: blast-radius engineering. The prior episode built layers that prevent a bad action. This one assumes prevention fails and bounds the damage. Defense in depth across five layers:

• Claude-side: permission deny/ask/allow ordering, defaultMode dontAsk, the sandbox (failIfUnavailable, allowUnsandboxedCommands false, denyRead on credentials), PreToolUse hooks, --bare, --max-turns. Plus CVE-2026-25725 (SecurityWeek): why you bound damage outside the tool.
• AWS: least-privilege IAM, permissions boundaries, Access Analyzer policy generation, STS short-lived creds, SCPs, egress control, and Budgets actions.
• GitHub: scoped GITHUB_TOKEN, OIDC to AWS, branch protection, and environment reviewers.

The pitfall: "it only opens a PR" ignores pull_request_target, which runs fork code with base-repo secrets (2i2c, OpenSSF). See the spotipy and openlit advisories.