Anthropic released Claude Code 2.1.216 to fix a critical issue where AI coding agents would lose their permission restrictions when pausing and resuming work, potentially exposing broader capabilities than intended. The update ensures that when a restricted agent returns from the background, it retains its original role, tool access, and workspace boundaries instead of reverting to a default, unrestricted state.

Why Does It Matter When an AI Agent Forgets Its Restrictions?

Imagine assigning an AI agent a narrow task: review code changes without editing them, or inspect logs without deploying anything. That agent receives specific restrictions to prevent it from doing more than intended. But if the agent pauses mid-task and resumes later, what happens to those restrictions? According to a bug report filed on July 18, the agent's conversation history would survive the handoff, but its safety guardrails would not.

This mismatch is dangerous because both the user and the AI model might assume the agent is still operating under its original constraints. A read-only reviewer that silently becomes a general agent with full editing capabilities has acquired a different action surface, and that shift happens invisibly. In multi-agent workflows where different agents handle different parts of a codebase, a single agent losing its restrictions could contaminate shared work, flip branches, or expose credentials it should never touch.

What Exactly Did the Update Fix?

The Claude Code 2.1.216 release, which appeared in Anthropic's npm registry on July 20, addresses four distinct boundaries where agent authority can separate from the conversation it governs:

• Agent Identity: The system prompt and role that define what the agent is supposed to do now persist when a session resumes from the background.
• Tool Capability: The specific tools and permission policies that define what the agent may do are restored alongside the conversation history, rather than defaulting to a broader toolset.
• Workspace Isolation: Git worktree boundaries are now enforced more strictly, preventing agents from redirecting Git commands into shared repositories through command-line options or environment variables.
• Recovery Scope: Rewind and checkpoint features now skip symlinks and hard links, preventing recovery operations from following paths outside the intended project directory.

The worktree isolation fix is particularly technical but important. Worktrees allow multiple agents to work on separate branches without cloning an entire repository. However, Git accepts its own control-plane inputs that can override the current directory. Version 2.1.216 blocks four specific routes through which an agent could redirect Git into the shared checkout: the git -C option, the --git-dir flag, the GIT_DIR environment variable, and GIT_WORK_TREE.

How to Verify Agent Permission Continuity in Your Workflows

If you use Claude Code with custom agents in production, here are practical steps to ensure permissions survive session transitions:

• Test Agent Resumption: Create a restricted agent with a specific role and limited tools, pause the session, then resume it and verify the agent still reports the same tool restrictions in its interface.
• Validate Worktree Boundaries: When using multiple agents on the same repository, confirm that each agent's Git operations stay within its assigned worktree by checking branch and file changes after resumption.
• Audit Rewind Operations: After using rewind or checkpoint features, verify that recovery operations did not follow symlinks or hard links outside your project directory, which could expose unintended files.
• Monitor Multi-Agent Runs: In workflows with multiple agents, watch for unexpected branch changes or file modifications that might indicate one agent's workspace leaked into another's.

The release notes do not expose the underlying implementation or linked pull requests, so the fixes remain claims attributable to Anthropic's documentation rather than an independent audit of the binary. However, the scope of the update suggests the company is treating agent permission continuity as a foundational security property, not a minor bug fix.

What Does This Mean for the Broader Coding Agent Landscape?

Production coding agents are increasingly delegated narrow, specialized jobs. A code reviewer should not have deployment access. A dependency researcher should not reach credentials. A log inspector should not edit production files. As AI agents become more autonomous and more integrated into team workflows, the boundary between what an agent is supposed to do and what it is permitted to do becomes a critical security surface.

The Claude Code update reveals that this boundary is harder to maintain than static permission screens suggest. Backgrounding, resuming, forking, restoring, and switching worktrees are exactly where metadata can separate from the conversation it governs. A session that looks continuous to the user might have lost its contract underneath. Anthropic's fix tests whether agent identity, capability, workspace, and recovery scope can remain bound together through these transitions, which is a question that will matter increasingly as coding agents become more common in enterprise environments.