When you're sitting in front of an agent, "don't touch anything outside src/ " is enforced by you noticing. Unattended, it has to be enforced by something that runs whether or not anyone is watching. Claude Code gives you two mechanisms for that, and they are not interchangeable.
Source: [Dev.to](https://dev.to/fewparts/how-to-stop-a-claude-code-agent-writing-outside-a-directory-253p)