What the /permissions command does in Claude Code: inspect and edit rules
Use /permissions to see every rule and which settings file it came from, add or remove rules mid-turn, and work the Auto mode and Recently denied tabs.
Contents
Most permission trouble comes down to not knowing which rule is actually in force. Settings live in user, project, local and managed files at once, and following that by hand means missing something.
/permissions shows all of it in one place: every rule, which settings.json it came from, and controls to add or remove rules on the spot.
KEY POINT
What you will learn
- What
/permissionsshows, and what you can edit there - Which settings file a rule you add gets written to
- What the Auto mode and Recently denied tabs are for
Seeing the rules and where they come from
Running /permissions lists every permission rule together with the settings file that defines it. When a command you thought you allowed keeps prompting, this is where you find the ask or deny rule from another scope that is winning.
The dialog opens while Claude is working. Adding or removing a rule takes effect from the next tool call in the same turn. Before v2.1.234 the command waited until the turn ended.
用語解説
Claude does not decide the rules: permission rules are enforced by Claude Code itself, not by the model. Instructions in your prompt or CLAUDE.md change how Claude behaves, but not what Claude Code permits. To grant or revoke, use /permissions, rules in a settings file, a permission mode, or a PreToolUse hook.
Where a rule you add is written
A rule added through /permissions belongs to the settings file you save it to, and that matters for /path patterns, because a single leading slash anchors at the settings source rather than the filesystem root.
| Saved to | /path anchors at |
|---|---|
Project settings .claude/settings.json | The primary working directory |
Local settings .claude/settings.local.json | The primary working directory |
User settings ~/.claude/settings.json | ~/.claude/ |
Approvals you give at a permission prompt follow different rules. Choosing "Yes, and don't ask again" for something that persists — a Bash command, a WebFetch domain — writes to .claude/settings.local.json at the git repository root, and applies to every session under that repository. File-edit approvals are not persisted and expire with the session.
:::warning{title="Sometimes there is no "don't ask again""}
When Claude Code can't display what a rule would permit, for instance because the command or the edit is very long, it omits the persistent-approval option. Approve once, then write the rule yourself in /permissions if you want it to stick.
:::
The Auto mode and Recently denied tabs
In sessions where auto mode is available, the dialog gains an Auto mode tab for editing the classifier's rules without opening a settings file. It requires Claude Code v2.1.246 or later.
- It lists the
allow,soft_deny,hard_denyandenvironmententries per scope the classifier reads - Entries from managed settings or
--settingsare read-only; everything you edit is saved to~/.claude/settings.json - Adding the first rule to a section also inserts
"$defaults", so the built-in rules stay in place
The Recently denied tab records actions the auto-mode classifier refused. Select a row and press r to mark it for retry; when you close the dialog, Claude Code sends a message saying the call may be retried and the conversation resumes.
The denial log has gaps
When the classifier can't reach a decision, Claude Code denies the action but does not record it under Recently denied. The tab also shows shell commands using Claude's own description of them. When you need the exact input, take tool_input from a PermissionDenied hook.
What could not be confirmed
Whether the permission mode itself can be switched from /permissions could not be confirmed in the official documentation. The documented way to change modes is cycling with Shift+Tab. Adding a working directory is the same: /add-dir and the additionalDirectories setting are the documented routes.
For designing the rules themselves, see Claude Code permissions in settings.json. For a concrete deny example, see Stop Claude Code reading your .env.
Summary
/permissionslists every rule with the settings file it came from- It opens mid-turn, and changes apply from the next tool call
- A
/pathpattern anchors at the settings file you saved it to, so pick the scope deliberately - Persistent "don't ask again" approvals land in
.claude/settings.local.jsonat the repository root - Auto-mode sessions add the Auto mode and Recently denied tabs
FAQ
- Can I open /permissions while Claude is working?
- Yes. The dialog opens mid-turn, and adding or removing a rule takes effect from the next tool call in that same turn. Before v2.1.234 the command waited for the turn to finish.
- Where does a "Yes, and don't ask again" approval get saved?
- Approvals that persist, such as Bash commands and WebFetch domains, are written to .claude/settings.local.json at the git repository root. File-edit approvals are not saved and expire with the session.
- Can I switch permission mode from /permissions?
- That could not be confirmed in the official documentation. The documented way to switch modes is cycling with Shift+Tab.
Primary sources
This article was drafted by AI from official documentation and reviewed by the site operator before publishing. Found a mistake? Let us know via the contact page.