Developers on a team are interrupted by a permission prompt for nearly every build and test command Claude Code runs in Bash. Security does not want developers to bypass permission checks entirely, and wants commands that run on a laptop to be unable to write outside the project or reach arbitrary network hosts. Which approach reduces the prompts while keeping those limits?