The Agency Permission Checklist Before Claude Code Edits a Client Site

Agency work is full of small edits: a landing page CTA, a hero headline, a campaign date, a testimonial intro. Claude Code can make those edits quickly, but a client site needs boundaries before speed. The question is not only “can the AI edit this?” It is “what is it allowed to touch?”

This checklist is for web agencies, marketing teams, and consultants who maintain WordPress, Astro, Next.js, static landing pages, and campaign pages with forms.

Key takeaways

• Before Claude Code edits anything, separate files into read-only, editable, and forbidden.
• Delegate the diff, build, link checks, and mobile layout checks. Keep client approval and publish decisions with humans.
• Protect customer data, ad tags, form destinations, analytics, payment settings, and legal copy.
• Solo users should start with the free PDF. Agencies standardizing the workflow should use the setup guide. Multi-person client work belongs in consultation.

Split permission into three levels

Most agency accidents are scope accidents. Someone asks for “the CTA on this page” and the edit spills into a shared header, a tracking tag, or a form destination.

Use three levels before you write the prompt.

Level	Meaning	Example
Read-only	Claude Code may inspect, but not change	Existing LP, design reference, previous CTA
Editable	Files allowed for this task	Target page, copy data, test copy
Forbidden	Do not open unless absolutely needed; never edit	.env, customer lists, ad pixels, payment settings

This table turns a vague request into a bounded task. AI does better when the boundary is written down.

What Claude Code handles

Claude Code can produce the diff, change button text, keep the link target, run a build, and check mobile width. Those tasks are concrete.

Humans decide whether the copy matches the client’s brand, legal claims, campaign promise, and ad creative. Publishing is also a human approval point.

Copy-paste instruction

Change only the CTA copy on this client landing page.

Editable:
- site/src/pages/campaign.astro
- site/src/content/campaign-copy.ts

Read-only:
- site/src/layouts/BaseLayout.astro
- site/src/components/Header.astro

Do not touch:
- .env*
- form action / submission destination
- analytics, ads, or pixel code
- pricing, contracts, legal, privacy policy

Task:
1. Make the CTA headline shorter
2. Change the button label to "Book a free consultation"
3. Keep the link target as /training/
4. Run npm run build
5. Report the diff and verification result

The important part is the separation between read-only and editable. Claude Code may need context, but reading context is not permission to edit it.

A tiny guard script

This Node.js snippet fails if a diff appears to touch forbidden areas.

const diff = process.env.DIFF_TEXT || "";
const forbidden = [".env", "gtag(", "fbq(", "stripe", "customer_email"];

const hits = forbidden.filter((word) => diff.includes(word));
if (hits.length) {
  console.error("possible forbidden diff:", hits.join(", "));
  process.exit(1);
}

console.log("forbidden-word check passed");

In real work, pass git diff into DIFF_TEXT. It is not perfect, but it catches common mistakes around tracking, payment, and customer data.

Three use cases

1. Button copy on a landing page Editable scope is only the target page. Form destination, tags, and pricing stay forbidden. Check the button on mobile before publishing.

2. Shortening a case-study intro Put past examples in read-only scope, but edit only the target article. Customer names, performance numbers, and industry claims need human approval.

3. Campaign date replacement Even a date touches OGP, structured data, CTA links, and form deadlines. Let Claude Code list affected spots; let the account owner approve publication.

Pitfalls and fixes

Pitfall 1: “Make this area nicer” That invites wide edits. List the files first.

Pitfall 2: No forbidden list .env, ad tags, payment, and forms must be named as protected areas.

Pitfall 3: Publishing after build only A build cannot tell you if a CTA target or canonical is wrong. Check public URL, h1, link target, and mobile layout.

Pitfall 4: Stronger claims before approval “Best,” “guaranteed,” and “No. 1” need proof. A human must stop unsupported claims.

CTA: next step

If you are learning solo, keep the free Claude Code cheatsheet nearby. If your agency needs consistent CLAUDE.md rules, permissions, hooks, and setup habits, the setup guide is the best paid next step.

For multi-person client work, use training and consultation to design real read-only, editable, and forbidden zones around your projects. Pair this with the permissions guide and the team rollout risk register.

What happened when I tried it

I applied this checklist to a landing-page CTA edit. I limited editable files to two, placed form destinations and tracking tags in the forbidden list, then verified build and mobile layout.

The biggest improvement came from separating read-only from editable. Claude Code could inspect enough context without widening the diff. In agency work, the written boundary matters as much as the model’s ability.