Three things to lock down before you ship your first Claude Code routine

1. Strip the connectors and repo access down to what this one routine needs

The failure mode: You set up a nightly PR-triage routine with your default connectors attached, and now an unattended session has write access to Slack, Linear, and every repo you own.

When you create a routine, Anthropic includes every MCP connector you already have connected. That is not least-privilege. That is maximum reach with one click.

A routine that reads GitHub issues and posts to one Slack channel does not need Google Drive, does not need Linear write, and does not need push access to a repo it will never open. For example:

• Remove every connector that is not part of this routine's specific job.
• Attach only the repos it actually reads or writes.

If the routine does not need outbound network beyond the repo and a named API, use a custom environment with network access restricted to those hosts.

Example scoping for a nightly PR-triage routine:

Repos: web-app (read only)
Connectors: GitHub, Slack (write to #eng-pr-triage only)
Network: github.com, slack.com
Env vars: none

2. Keep the claude/ branch default on, and treat the PRs it opens like any other PR touching critical files

The failure mode: The routine opens a PR against a file marked AUTH-CRITICAL, the PR carries your GitHub identity, a tired reviewer assumes you wrote it, and it merges without the review that file requires.

By default, a routine can only push to branches prefixed with claude/.

Leave that default on for any repo with auth, payment, or personal-data code. That single setting forces every routine change through a pull request, which forces it through review.

The review itself is where people get casual because a routine runs as "you" with commits carrying your GitHub user and PRs would look like something that you opened.

That however is an output from an unattended session that had no one asking clarifying questions while it worked.