Configure permissions

​

Permission system

​

Manage permissions

• Allow rules let Claude Code use the specified tool without manual approval.
• Ask rules prompt for confirmation whenever Claude Code tries to use the specified tool.
• Deny rules prevent Claude Code from using the specified tool.

​

Permission modes

​

Permission rule syntax

​

Match all uses of a tool

​

Use specifiers for fine-grained control

​

Match by input parameter

• The parameter name must be a direct field of the tool’s input, such as model on the Agent tool. Fields nested inside an object or array are not matchable
• Each rule names one parameter. To gate on both model and isolation, write two rules, Agent(model:opus) and Agent(isolation:worktree), rather than combining them in one rule
• The value supports * as a wildcard that matches any sequence of characters, so Agent(isolation:*) matches any explicit isolation value. Without * the match is exact
• A parameter the model omits is never matched, so Agent(model:*) doesn’t match a call that leaves model unset
• The value is compared against the literal input Claude sends, before any normalization. Agent(model:opus) matches the alias opus but not a full model ID. Run with --verbose to see the exact parameter names and values in each tool call
• Whitespace around the colon is ignored

​

Wildcard patterns

{
  "permissions": {
    "allow": [
      "Bash(npm run *)",
      "Bash(git commit *)",
      "Bash(git * main)",
      "Bash(* --version)",
      "Bash(* --help *)"
    ],
    "deny": [
      "Bash(git push *)"
    ]
  }
}

​

Tool name wildcards

{
  "permissions": {
    "deny": [
      "mcp__*"
    ]
  }
}

​

Tool-specific permission rules

​

Bash

• Bash(npm run build) matches the exact Bash command npm run build
• Bash(npm run test *) matches Bash commands starting with npm run test
• Bash(npm *) matches any command starting with npm
• Bash(* install) matches any command ending with install
• Bash(git * main) matches commands like git checkout main and git log --oneline main

​

Compound commands

​

Wrappers

​

Read-only commands

• Unquoted globs for commands with write-capable flags: commands with write-capable or exec-capable flags, such as find, sort, sed, and git, prompt when an unquoted glob is present, because the glob could expand to a flag like -delete.
• docker pointed at another daemon: read-only forms of docker prompt when the command carries a flag that selects a different daemon, such as -H, --context, or Podman’s --url and --connection.
• file with path-opening flags: file prompts when it passes -m/--magic-file or -f/--files-from, because those flags make file open the paths named in the flag’s value.
• Network paths on Windows: a command whose arguments include a network (UNC) path, such as \\server\share\file, prompts because accessing a network path can send your Windows credentials to the host it names. The same check applies to PowerShell tool commands.
• Commands the analysis can’t parse: when Claude Code can’t fully parse a command, it asks for approval instead of treating the command as read-only. Commands longer than 10,000 characters always prompt because they exceed what the analysis parses.

• cd with git: prompts when the cd changes into a different directory, since running git in a new directory can execute that directory’s hooks. A cd whose target resolves to the current working directory is a no-op and doesn’t trigger the prompt.
• cd with an output redirect: prompts when Claude Code can’t determine which directory the redirect target resolves against after the cd runs. A command whose only redirect target is /dev/null, such as cd app; grep -r pattern . 2>/dev/null, doesn’t prompt, because /dev/null doesn’t depend on the working directory.

​

PowerShell

{
  "permissions": {
    "allow": [
      "PowerShell(Get-ChildItem *)",
      "PowerShell(git commit *)"
    ],
    "deny": [
      "PowerShell(Remove-Item *)"
    ]
  }
}

​

Read and Edit

• Edit(/docs/**): edits in <project>/docs/, not /docs/ or <project>/.claude/docs/
• Read(~/.zshrc): reads your home directory’s .zshrc
• Edit(//tmp/scratch.txt): edits the absolute path /tmp/scratch.txt
• Read(src/**): as an allow rule, reads from <current-directory>/src/ only; as a deny or ask rule, matches a src directory at any depth under the current directory

• Allow rules: Edit(src/**) matches only <cwd>/src and the files under it. To allow a directory name at any depth, write Edit(**/src/**).
• Deny and ask rules: Read(secrets/**) matches a directory named secrets at any depth under the current directory, so the rule also applies to nested copies.

<current-directory>/
├── src/
│   └── app.ts
└── vendor/
    └── pkg/
        └── src/
            └── lib.js

• Allow rules: apply only when both the symlink path and its target match. A symlink inside an allowed directory that points outside it still prompts you.
• Deny rules: apply when either the symlink path or its target matches. A symlink that points to a denied file is itself denied.

​

WebFetch

• WebFetch(domain:example.com) matches requests to example.com
• WebFetch(domain:*.example.com) matches any subdomain at any depth, such as api.example.com or a.b.example.com, but not example.com itself
• WebFetch(domain:*) matches every domain and is equivalent to a bare WebFetch rule

​

MCP

• mcp__puppeteer matches any tool provided by the puppeteer server
• mcp__puppeteer__* uses wildcard syntax and also matches all tools from the puppeteer server