Made a 20-line bash script that wraps SSH, regex whitelist for safe commands, instant reject for dangerous ones(rm, mv, chmod). Claude Code doesn't even know it's restricted. Production-tested for 6 months. The autonomy is chef's kiss, the audit logs saved me twice.