Permissions

Permission philosophy

Claude Code follows the principle of least privilege: by default it asks for confirmation for any action that is potentially irreversible or affects resources outside your project. You decide when to give it more autonomy.

Tools and their permissions

Claude Code has access to these tools, each with its default risk level:

Allowing and denying operations

Configure permissions in .claude/settings.json so you don't have to confirm frequent operations:

{
  "permissions": {
    "allow": [
      "Bash(npm run:*)",
      "Bash(git:*)",
      "Bash(npx:*)",
      "Read(**)",
      "Edit(**)",
      "Write(**)",
      "WebFetch(domain:api.github.com)"
    ],
    "deny": [
      "Bash(rm -rf:*)",
      "Bash(sudo:*)",
      "WebFetch(domain:*.evil.com)"
    ]
  }
}

Permission syntax

Permissions use the format Tool(pattern:value):

• Bash(npm:*) — allows any npm command
• Bash(git commit:*) — allows git commit with any argument
• Read(**) — allows reading any file (** = any path)
• WebFetch(domain:api.example.com) — allows fetch only to that domain
• Edit(src/**) — allows editing only files under src/

Interactive permission management

Inside Claude Code, use the command:

/permissions

This opens an interactive panel where you can view, add, or revoke permissions for the current session.

Permissions during a session

When Claude Code requests to do something you haven't pre-authorized, it will show you a dialog like this:

Claude wants to run:
  git push origin main

Allow? [y/N/always/never] _

• y — allow only this time.
• N — deny (Claude will look for another alternative).
• always — add to the permanent permissions list.
• never — add to the permanent deny list.

No-permissions mode (dangerous)

For controlled environments (CI, Docker, sandboxes), you can disable all confirmations:

claude --dangerously-skip-permissions "implement the unit tests"

Security best practices

• Use git: working in a git repository lets you revert any change Claude made with git restore .
• Limit scope in production: on production servers, don't give Claude write permissions.
• Review diffs: Claude always shows a diff before editing. Read it before accepting.
• Domain-specific permissions: if you use WebFetch, specify exact domains instead of WebFetch(*).
• Environment variables: Claude cannot read your secrets unless they are in the environment or you pass them explicitly.

Team permission configuration

Add .claude/settings.json to your repository so the entire team uses the same base permission configuration:

# .gitignore — do NOT ignore the team's settings.json
# (do ignore settings.local.json for personal configs)
.claude/settings.local.json

August 2026 update: Auto mode is not bypass

Auto mode uses a classifier to decide whether an action can run or must stop. Availability and activation may depend on your account and managed policy. Do not assume every session starts in Auto mode: check /permissions or /config for the effective mode.

Auto mode is a decision layer, not a safety guarantee. Keep secrets out of context, inspect git diff before publishing, and use an isolated environment for tasks that can delete data or modify production.

Verified sources

Review the current Anthropic IAM and CLI reference together with the Claude Code v2.1.233 release notes. This lesson was reviewed on August 16, 2026.