Permissions & tool allowlists

Permissions and tool allowlists in Claude Code form a security gateway that controls which tools Claude can use automatically, which require explicit human approval, and which are blocked outright. The system evaluates rules in a strict hierarchy: deny rules fire first and block unconditionally, then allow rules grant silent auto-approval, and anything not matched either prompts the user or is blocked depending on the active permission mode. Rules are expressed as strings like 'Bash(npm run test)' or 'Read(~/.zshrc)' and stored in settings.json files at the global (~/.claude/settings.json) or project (.claude/settings.json) level. Permission modes set the overall posture of the session. The default mode ('default') asks before most tool uses. 'acceptEdits' silently approves file read/write operations but still prompts for shell commands. 'bypassPermissions' silently approves everything (hooks can still block actions). 'dontAsk' prevents all tool execution — useful for read-only analysis. These modes can be set via the CLI flag --permission-mode, via the SDK's permissionMode option, or toggled interactively during a session. The feature is mandatory for any autonomous or semi-autonomous Claude Code workflow. Without it, every file write and shell command requires manual approval. With it, developers can define precise safe corridors — for example, allowing npm test but blocking npm install — so Claude can work quickly on permitted tasks while dangerous operations are caught automatically before execution.