Claude Code permissions in settings.json: allow, deny and ask rules with real examples

By default, Claude Code asks before every file edit and every shell command. That is safe, but it kills your momentum. Granting everything, on the other hand, lets irreversible operations such as rm -rf or git push --force run without a second look.

This article shows how to use the permissions block in settings.json to draw the line: safe operations run automatically, dangerous ones are confirmed or blocked.

Where settings.json lives and which scope wins

Scope	Path	Purpose	In Git
User	~/.claude/settings.json	Defaults for all your projects	No
Project	.claude/settings.json	Rules shared with the team	Yes
Local	.claude/settings.local.json	Personal additions; where "always allow" is saved	No
Managed	OS-specific policy location	Rules enforced by an organization (Enterprise)	-

When several files define the same key, managed settings win, then local, then project, then user. deny is always stronger than allow, so anything the team wants to forbid belongs in the project deny list: no personal allow can override it.

The shape of the permissions block

{
  "permissions": {
    "allow": [
      "Read",
      "Edit",
      "Bash(npm run lint)",
      "Bash(npm run test:*)",
      "Bash(git diff:*)",
      "Bash(git log:*)"
    ],
    "ask": [
      "Bash(git push:*)",
      "Bash(npm install:*)"
    ],
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)",
      "Bash(rm -rf:*)",
      "Bash(git push --force:*)"
    ],
    "defaultMode": "acceptEdits"
  }
}

Key	Meaning
allow	Rules that run without confirmation
ask	Rules that always prompt, even if an allow rule also matches
deny	Rules that are blocked. Highest priority
defaultMode	What happens to operations that match no rule: default (prompt), acceptEdits (edits run, commands prompt), plan (read-only), bypassPermissions (everything runs; isolated environments only)

Rule syntax

A rule is ToolName(pattern). Omit the pattern to match the whole tool.

Rule	Matches
Bash(npm run test:*)	Any command starting with npm run test (:* is a prefix match)
Bash(git commit *)	git commit followed by space-separated arguments
Read(./.env)	Reading .env at the project root
Edit(src/**)	Editing any file under src
WebFetch(domain:docs.example.com)	Fetching from that domain
mcp__github__create_issue	The create_issue tool of the MCP server named github
mcp__github	Every tool of that MCP server

Recommended setup: solo projects

Edits run automatically; anything that touches the outside world is confirmed.

{
  "permissions": {
    "defaultMode": "acceptEdits",
    "allow": [
      "Bash(npm run *)",
      "Bash(npx tsc *)",
      "Bash(git status)",
      "Bash(git diff:*)",
      "Bash(git log:*)",
      "Bash(git add:*)",
      "Bash(git commit:*)"
    ],
    "ask": [
      "Bash(git push:*)",
      "Bash(npm install:*)",
      "Bash(npm uninstall:*)"
    ],
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Bash(rm -rf:*)",
      "Bash(git push --force:*)",
      "Bash(git reset --hard:*)"
    ]
  }
}

Recommended setup: teams

Keep only two things in the shared .claude/settings.json: deny rules everyone must respect, and allow rules that are safe no matter who runs them. Leave personal preferences to settings.local.json.

{
  "permissions": {
    "allow": [
      "Bash(pnpm lint)",
      "Bash(pnpm test:*)",
      "Bash(pnpm typecheck)"
    ],
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./infra/secrets/**)",
      "Edit(./.github/workflows/**)",
      "Bash(git push --force:*)",
      "Bash(git push -f:*)",
      "Bash(rm -rf:*)",
      "Bash(curl:*)",
      "Bash(wget:*)"
    ]
  }
}

curl and wget are denied to stop arbitrary downloads and data exfiltration. Move them to ask if you need them.

Grants made during a session and /permissions

When you choose "always allow" in a confirmation prompt, the rule is appended to the allow list of settings.local.json. These grants accumulate quietly, so review them with the /permissions command from time to time and remove what you no longer need.

If you are unsure which files are in effect, claude config list and /status show where the current settings were loaded from.

Related settings

Permissions decide what runs; hooks let you enforce follow-up work such as running the linter after every edit, which makes wider automation safer. See Run lint and format automatically with Claude Code hooks. Keeping secrets out of the model's reach is covered in Stop AI coding tools from reading your API keys and secrets.

Summary

• Settings override in the order user → project → local, and deny always wins
• Write rules as Tool(pattern), for example Bash(npm run test:*)
• Start with defaultMode: "acceptEdits" plus a short allow list, and put dangerous operations in deny
• Review grants added during sessions with /permissions

{
  "permissions": {
    "deny": ["Read(./.env)", "Read(./.env.*)"]
  }
}