Give Automation the Least Access
Give unattended automation only the access its job needs, and have Claude list every permission it keeps and why.
Where you'll practice this
One Promptles scenario teaches this principle directly.
Lock Down the Review Workflow
Bao wants Claude to review every pull request to Courtside, so a maintainer copied a workflow from a blog post that runs `anthropics/claude-code-action`. It runs on `pull_request_target` (a trigger that hands the job the repo's secrets even for pull requests from forks), checks…
Other principles in Constraints
Define Component Boundaries
When splitting a component, give the decisions already made and say nothing on screen should change.
Define Inputs and Outputs
Say what goes in, what comes out, and what happens with bad input. Leave the inside to Claude.
Define the Business Logic
Turn business words into exact rules: the fields, the thresholds, and how they combine.
Deprecate Before Removing
Keep the old name working for a release, point to the replacement, and announce when it goes away.
Describe Edge Cases
Name the unusual cases you know about and what should happen in each.
Describe Type Contracts
Tell Claude the rules the code doesn't show, like allowed values and optional fields. It can work out the rest.