Skip to content
Claude Code Docs Claude Code Docs

Permissions Overview

Claude Code Permission Rules

Section titled “Claude Code Permission Rules”

New here? Start with GettingStarted/first-permission-rule.md to learn how to add your first allow/deny rule in 2 minutes. The sections below are the full reference — you don’t need all 10 sections to get started.

Reference for the permission rule grammar, evaluation model, and related subsystems. Rules gate which tool invocations Claude can run automatically vs. require user approval vs. block entirely.

Table of Contents

Section titled “Table of Contents”
  1. How permissions are evaluated
  2. Rule grammar
  3. Permission modes
  4. Rule scopes
  5. Auto-mode classifiers
  6. Rule updates
  7. Related settings keys
  8. Hooks and permissions
  9. Additional / undocumented rule-related subsystems
  10. Discrepancies & notes

Overview

Section titled “Overview”

10 sections, 14 entries across grammar forms, modes, and subsystems.

#SectionDescriptionEntries
1How permissions are evaluatedEvaluation order (dangerous patterns → hooks → deny → allow → default mode), scope precedence, and classifier sub-layer.narrative
2Rule grammarRule forms (Tool, Tool(pattern), mcp__server__tool), per-tool pattern syntax, and what the parser rejects.8 entries
3Permission modesThe six permission modes — default, acceptEdits, plan, auto, dontAsk, bypassPermissions — with behavior and use cases.6 entries
4Rule scopesManaged → project → user → session precedence and how conflicts are resolved across layers.narrative
5Auto-mode classifiersbashClassifier, yoloClassifier, classifierDecision — the heuristic auto-approval subsystem.narrative
6Rule updatesMutation types emitted by /permissions and runtime callers (addRules, removeRules, setMode, etc.).narrative
7Related settings keysCross-links to the permissions.*, autoMode, and skip*PermissionPrompt keys documented in Settings.narrative
8Hooks and permissionsHow PreToolUse hooks can approve or block tool calls before permission evaluation runs.narrative
9Additional / undocumented rule-related subsystemsSource-tree files whose names hint at features not in public docs (dangerousPatterns, shadowedRuleDetection, bypassPermissionsKillswitch, denialTracking).narrative
10Discrepancies & notesKnown gaps between public docs and source — hidden bubble mode, symlink asymmetry, compound command expansion, escaping order.narrative

Quick reference — rule pattern by tool

Section titled “Quick reference — rule pattern by tool”
ToolPattern formExampleWildcardsNotes
Bashfull-command or prefix with *Bash(npm run build), Bash(npm *), Bash(* install)* at any position; space-enforced word boundarySupports compound commands (&&, ||, ;). Process wrappers (timeout, nohup, etc.) are stripped. Read-only commands (ls, cat, grep) auto-allowed in most modes.
Readglob path (gitignore syntax)Read(src/**/*.ts), Read(~/.zshrc), Read(//tmp/*)*, **, ?, {a,b} brace expansionRelative to cwd or project root; ~ for home; // for absolute. Symlink targets checked separately.
Writeglob path (gitignore syntax)Write(build/**)*, **, ?, {a,b}Same path semantics as Read. Protected dirs (.git, .claude, .vscode, .idea, .husky) always prompt in bypassPermissions mode.
Editglob path (gitignore syntax)Edit(/src/**/*.js)*, **, ?, {a,b}Same path semantics as Read. Applies to all file-edit tools.
WebFetchdomain suffix (no wildcard)WebFetch(domain:anthropic.com)No; suffix-match onlydomain: prefix required. Matches *.anthropic.com and anthropic.com (suffix-match).
WebSearchno patternWebSearchN/ARule name only; no specifier. Controls WebSearch tool access.
Agentsubagent type nameAgent(Explore), Agent(my-custom-agent)No literal wildcard; exact name matchDeny rules block subagent invocation.
Skillskill nameSkill(validate-sql)No literal wildcard; exact name matchGated like other tools when invoked via Skill tool.
mcp__*MCP server and toolmcp__slack__*, mcp__slack__slack_send_message* for all tools on a serverLiteral mcp__server__tool or wildcard mcp__server__*. See MCP patterns.
Monitor, Config, TodoWrite, etc.no pattern (if not documented otherwise)MonitorN/ATool-specific. Most do not accept patterns; apply to all uses.

See Also

Section titled “See Also”