Permissions

Control which tools Claude can use automatically and which require your approval.

Claude Code runs tools on your behalf — reading and writing files, executing shell commands, making network requests. The permissions system gives you precise control over which tools run automatically and which pause to ask for your approval.

How permissions work

Every tool use goes through a permission check before Claude executes it. The outcome is one of:

• Allow — the tool runs immediately without prompting you
• Ask — Claude pauses and shows you a confirmation prompt
• Deny — the tool is blocked and Claude receives an error

The decision is made by evaluating your configured rules against the tool name and its input. If no rule matches, Claude prompts you at the ask level.

Permission rules

Rules are written in a simple syntax: ToolName or ToolName(content).

Rule	Matches
Bash	Any Bash command
Bash(git *)	Bash commands starting with git
Bash(npm run *)	Bash commands starting with npm run
Read	Any file read
Write	Any file write
mcp__my-server	All tools from the MCP server named my-server
mcp__my-server__search	The search tool from my-server

Rules support * as a wildcard that matches any sequence of characters.

Configuring rules in settings

Add rules to the permissions object in your settings file. Rules can be set at the user level (~/.claude/settings.json) or the project level (.claude/settings.json or .claude/settings.local.json).

{
  "permissions": {
    "allow": [
      "Bash(git *)",
      "Bash(npm run *)",
      "Read",
      "Write"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(git push --force *)"
    ],
    "ask": [
      "Bash(npm publish)"
    ]
  }
}

permissions.allow · string[]

Tools that run automatically without asking you.

permissions.deny · string[]

Tools that are always blocked. Claude receives an error and cannot proceed.

permissions.ask · string[]

Tools that always prompt for confirmation, even in modes that would otherwise skip prompts.

permissions.defaultMode · "default" | "acceptEdits" | "bypassPermissions" | "dontAsk" | "plan"

Default permission mode when Claude Code starts. See Permission modes below.

permissions.additionalDirectories · string[]

Additional directories to include in the permission scope. By default, Claude can only access files under the current working directory. Add paths here to grant access to directories outside it.

permissions.disableBypassPermissionsMode · "disable"

Set to "disable" to prevent users from entering bypass permissions mode in this project.

Permission modes

You can change how Claude handles permission prompts for an entire session using the permission mode toggle (press Shift+Tab to cycle through modes).

Mode	Behavior
default	Asks for approval on any tool that doesn’t have an explicit allow rule
acceptEdits	Automatically approves file edits within the working directory; still asks for shell commands
bypassPermissions	Skips all prompts — Claude runs tools without asking. Requires explicit acceptance of the warning dialog
dontAsk	Converts all ask decisions to deny. Claude cannot use tools it doesn’t already have permission for
plan	Read-only mode: Claude can read and analyze but cannot write files or run commands

bypassPermissions mode turns off all permission prompts. Only use it in trusted environments where you have reviewed the task and understand the risks. Certain safety checks (such as writes to .git/, .claude/, and shell config files) still prompt even in bypass mode.

Approving tools at the prompt

When Claude needs to use a tool that requires approval, you see a prompt similar to:

Claude wants to run:
  Bash: npm install lodash

[y] Allow once   [Y] Always allow   [n] Deny once   [N] Always deny

Your choices:

• Allow once — permits this specific invocation; Claude will ask again next time
• Always allow — adds an allow rule to your local settings for this tool pattern
• Deny once — blocks this specific invocation; Claude receives an error
• Always deny — adds a deny rule to your local settings

When you select “Always allow” or “Always deny”, the rule is saved to .claude/settings.local.json in your project (gitignored) so it persists across sessions but doesn’t affect teammates.

The /permissions command

Run /permissions (or /allowed-tools) in a Claude Code session to open the interactive permissions panel. From there you can:

• View all current allow, deny, and ask rules
• See which settings file each rule comes from (user, project, local, or managed)
• Delete rules you no longer want
• Add new rules

Rule scopes and precedence

Rules from different sources are merged and evaluated together. A deny rule always takes precedence over an allow rule at the same level.

Source	File
User	~/.claude/settings.json
Project (shared)	.claude/settings.json
Project (local)	.claude/settings.local.json
CLI argument	--allow-tool, --disallow-tool flags
Managed	Enterprise managed settings

Use project settings (.claude/settings.json) to share safe defaults with your team, and local settings (.claude/settings.local.json) for personal rules you don’t want to commit.

Per-project permissions

Project settings let you define a consistent permission policy for everyone working on a codebase. For example, a project that uses make for its build system might allow those commands for all contributors:

{
  "permissions": {
    "allow": [
      "Bash(make *)",
      "Bash(go build *)",
      "Bash(go test *)",
      "Read",
      "Write"
    ],
    "deny": [
      "Bash(make deploy)"
    ]
  }
}

Commit this file as .claude/settings.json so every developer who clones the repository automatically inherits these rules.

MCP tool permissions

MCP server tools follow the same rule syntax. Use the mcp__serverName prefix to match tools from a specific server:

{
  "permissions": {
    "allow": [
      "mcp__filesystem",
      "mcp__github__create_issue"
    ],
    "deny": [
      "mcp__filesystem__write_file"
    ]
  }
}

Bypass permissions mode

You can start Claude Code with bypass permissions enabled using the --dangerously-skip-permissions flag:

claude --dangerously-skip-permissions

This flag sets the initial mode to bypassPermissions and skips the confirmation dialog. It is intended for automated CI/CD environments where you have pre-reviewed the task and there is no interactive terminal. Do not use this flag for interactive sessions on machines with sensitive data.

Even in bypass mode, writes to .git/, .claude/, .vscode/, and shell config files (.bashrc, .zshrc, etc.) still trigger a safety prompt. These paths are intentionally protected to prevent accidental corruption of version control state or your shell environment.

Enterprise permission controls

Enterprise administrators can restrict how users configure permissions through managed settings:

{
  "permissions": {
    "allow": ["Read", "Bash(git *)"],
    "deny": ["Bash(curl *)"],
    "defaultMode": "default"
  },
  "allowManagedPermissionRulesOnly": true,
  "permissions": {
    "disableBypassPermissionsMode": "disable"
  }
}

• allowManagedPermissionRulesOnly — only permission rules from managed settings are used; user and project rules are ignored
• disableBypassPermissionsMode — prevents users from entering bypass mode