Permission System — allow / ask / deny

~18 min · permissions, settings, safety, tools

Level 0🌱 Novice

0 XP0/70 lessons0/11 achievements

0/120 XP to next level120 XP to go0% complete

One file, three lists, deny-first evaluation

Claude Code's permission model is small on purpose: every tool call is matched against an allow, ask, or deny pattern, in that priority order, first match wins. Read tools always pass. Bash and Edit/Write don't.

Patterns are glob-style on tool specifiers: Bash(npm run *), Bash(git diff *), Read(./.env), WebFetch(domain:api.github.com). The pattern Bash alone means "any bash"; Bash(*) is equivalent. Wildcards work mid-string too, so Bash(* --dry-run) is a real, useful rule.

Settings layer like CLAUDE.md: enterprise managed → user global → project shared → project local (gitignored). That ordering is deliberate — security teams pin rules at the top, individuals customize at the bottom.

Code

A solid project default·json

// .claude/settings.json — committed, shared with the team
{
  "permissions": {
    "allow": [
      "Bash(npm run *)",
      "Bash(npm test *)",
      "Bash(npx prettier *)",
      "Bash(git diff *)",
      "Bash(git status)",
      "Bash(git log *)",
      "Bash(* --version)",
      "Bash(* --help *)",
      "Read"
    ],
    "ask": [
      "Bash(git push *)",
      "Bash(git commit *)"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(git push --force *)",
      "Bash(npm publish *)",
      "Read(./.env)"
    ]
  }
}

Inspect and edit live·bash

# Inside an active Claude Code session
/permissions

# Browse all active rules, see which file each comes from,
# add or remove rules interactively. Faster than editing JSON
# when you're in the middle of work.

External links

Exercise

Edit your .claude/settings.json in a real repo to add 5 allow rules (operations you re-approve every session) and 3 deny rules (commands you never want it running). Run a session and count how many prompts you saved. Commit the file.

Progress

Progress is local-only — sign in to sync across devices.

← PreviousCLAUDE.md — Project Memory Next →Slash Commands & /init, /compact, /cost, /effort

Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)

No comments yet — be the first.