Claude Code permissions: allow, ask and deny rules, rule syntax and allowed tools

• Allow rules let Claude Code use the matching tool without asking you.
• Ask rules prompt for confirmation every time the matching tool is used.
• Deny rules block the matching tool.
• Order is deny, then ask, then allow. The first match wins and specificity does not change the order, so a broad deny like Bash(aws *) beats a narrower allow like Bash(aws s3 ls).
• A deny rule with a bare tool name, such as Bash, removes the tool from Claude's context. A scoped deny such as Bash(rm *) keeps the tool and blocks only matching calls.

Rules are enforced by Claude Code, not by the model. Instructions in CLAUDE.md shape what Claude tries to do but do not change what it is allowed to do.

• Whole tool: Bash, Read or WebFetch with no parentheses. Bash(*) is the same as Bash.
• Bash: Bash(npm run build) matches that exact command. Bash(npm run *) matches every npm script. Put the * after the subcommand: Bash(git log *) allows only git log, while Bash(git *) allows every git command.
• Bash(ls *) needs a space after ls, so it does not match lsof. Bash(ls:*) is an equivalent way to write the trailing wildcard.
• Read and Edit use gitignore patterns. Read(./.env) blocks the .env file in the current directory, Read(./secrets/**) blocks a folder. Use Edit rules, not Write rules, for paths no tool may change.
• Paths: //path is absolute from the filesystem root, ~/path is from your home folder, /path is relative to the settings file's project, and path or ./path is relative to the current directory.
• WebFetch: WebFetch(domain:example.com) matches example.com only. Add WebFetch(domain:*.example.com) for subdomains.
• MCP: mcp__github matches every tool from the github server, mcp__github__get_* matches its get_ tools, and mcp__github__create_issue matches one tool.
• Subagents: Agent(Explore) or Agent(my-custom-agent). Put one in deny to stop Claude from using that subagent.

{
  "permissions": {
    "allow": [
      "Bash(npm run *)",
      "Bash(git commit *)",
      "WebFetch(domain:docs.example.com)",
      "mcp__github__get_*"
    ],
    "ask": ["Bash(git push *)"],
    "deny": [
      "Read(./.env)",
      "Read(./secrets/**)",
      "Bash(rm *)"
    ]
  }
}

Allow rules and additionalDirectories in a project's .claude/settings.json only take effect after you accept the workspace trust dialog for that folder. Deny and ask rules apply right away.

• --allowedTools (or --allowed-tools): tools that run without prompting, using the same rule syntax.
• --disallowedTools (or --disallowed-tools): deny rules for this session. "mcp__*" removes every MCP tool.
• --tools: limits which built-in tools exist at all, for example "Bash,Edit,Read".
• --add-dir: adds working directories Claude can read and edit. Save them in permissions.additionalDirectories to keep them.

claude -p "summarize recent changes" \
  --allowedTools "Bash(git log *)" "Bash(git diff *)" "Read" \
  --disallowedTools "Edit"

• A deny at any level cannot be allowed by another level. If user settings allow something and project settings deny it, it is denied, and the reverse is also true.
• Managed settings are highest. Even --allowedTools cannot override a managed deny, while --disallowedTools can add more restrictions.
• allowManagedPermissionRulesOnly makes managed settings the only source of permission rules.
• Set permissions.disableBypassPermissionsMode or permissions.disableAutoMode to "disable" to block those modes. They are most useful in managed settings.

Rules sit on top of the session's permission mode: default (Manual), acceptEdits, plan, auto, dontAsk or bypassPermissions. Set one with claude --permission-mode <mode> or permissions.defaultMode in settings. dontAsk denies anything that would prompt except tools your allow rules already approve. To run with no prompts at all, see the guide on allowing all commands in Claude Code.