diff --git a/.claude/settings.json b/.claude/settings.json
index 08645bd42b..5e13c19446 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -203,13 +203,13 @@
   "autoMode": {
     "allow": [
       "$defaults",
-      "Bash(supabase migration list:*) and other read-only `supabase` inspection subcommands inside the BigSimmo/Database repo",
       "Bash(npm run ledger:lookup:*) in the BigSimmo/Database repo",
       "Bash(npm run verify:pr-local:*) in the BigSimmo/Database repo",
       "Bash(npm run test:focused:*) in the BigSimmo/Database repo"
     ],
     "soft_deny": [
       "$defaults",
+      "Bash(supabase migration list:*) and other read-only `supabase` inspection subcommands inside the BigSimmo/Database repo — live linked provider inspection requires confirmation",
       "Bash(supabase db push:*) and Bash(supabase db reset:*) — schema mutation against the live `Clinical KB Database` project (ref sjrfecxgysukkwxsowpy)",
       "Bash(supabase functions deploy:*) — deploying Edge Functions to the live Supabase project",
       "Bash(npm run verify:release:*) and any non-offline `npm run eval:*` — provider-backed (live Supabase + OpenAI spend)"
diff --git a/tests/claude-code-settings.test.ts b/tests/claude-code-settings.test.ts
index 17af545e59..ffa7063cdd 100644
--- a/tests/claude-code-settings.test.ts
+++ b/tests/claude-code-settings.test.ts
@@ -86,6 +86,13 @@ describe("claude code permissions", () => {
       expect(deny, `${target} must stay denied — a staging key leaked on 2026-08-18`).toContain(target);
     }
   });
+
+  it("soft-denies live supabase inspection in auto mode", () => {
+    const allow = (settings.autoMode?.allow ?? []) as string[];
+    const softDeny = (settings.autoMode?.soft_deny ?? []) as string[];
+    expect(allow.some((rule) => rule.includes("supabase"))).toBe(false);
+    expect(softDeny.some((rule) => rule.includes("supabase migration list"))).toBe(true);
+  });
 });
 
 describe("claude hook registrations", () => {