Claude Code permissions: combining allow, ask and deny

When to use

• Your team wants a small set of repeatable commands to proceed while retaining review points for other actions.[1]

When not to use

• You need to prove that no process can read a file or access the network; one tool rule does not establish that isolation.[1]

Separate the decisions before choosing patterns

The documentation defines allow, ask and deny rules and evaluates them in the order deny, ask, allow. A more specific pattern does not change that precedence. A narrow allowance cannot create an exception to a broad denial, and a matching ask rule takes precedence over allow. List the operations required by your task before deciding which deserve a review point.[1]

A small configuration to inspect

{
  "permissions": {
    "allow": ["Bash(npm run build)"],
    "ask": ["Bash(git push *)"],
    "deny": ["Read(./.env)"]
  }
}

[1]

This original exercise uses an exact Bash command for the allowance and a wildcard for the variable portion of a push command. Do not assume npm run build -- --verbose matches the exact rule. Read(./.env) describes a file-tool read in the current directory; it does not prove that every possible shell-based read is blocked.[1]

Review the shape of the actual call

• Check that the JSON parses and merge new arrays into the existing permissions object while preserving existing rules.
• Inspect the active configuration with /permissions and check user, local, project and organization settings.
• Write down expected decisions for the exact build command, a build with extra arguments and a push command. If behavior differs, compare the actual call with the rule before broadening a wildcard.

[1]

Verification scope and next step

The JSON example was parsed locally, and the rule explanations were checked against the documentation. Claude Code prompts, organization policy and compound shell behavior were not exercised. When adopting the example, inspect /permissions in a disposable project and record expected and observed decisions. Review complex shell commands, alternate executable paths and network access against their specific documentation sections.[1]