this prevents claude from directly reading certain files, but doesn't prevent claude from running a command that dumps the file on stdout and then reading stdout... claude will just try to "cat" the file if it decides it wants to see it.

Yeah - that’s kinda what I was thinking. Unless you’re doing quite granular approvals it gets tricky.