Claude Code is Anthropic's official AI coding agent, used by developers at companies from startups to Fortune 500. Learn more →

How to Set Up Claude Code Permissions

Control exactly what Claude can and cannot do. From permission modes to allowed tools to directory access, here is everything you need to configure Claude Code safely.

Claude Code permissions are controlled through three modes (Default, Auto-accept Edits, and Plan Mode) plus allow/deny rules for specific tools and paths. You configure them in your settings files or toggle them live with Shift+Tab. Once set up, every session respects your rules automatically.

This guide covers all three permission modes, how to configure allowed and denied tools, directory access controls, and security best practices to keep your codebase safe.

What Are Claude Code Permissions?

Claude Code permissions control what actions Claude can take during a session. They work at two levels:

• Permission modes: Global settings that control how Claude asks for approval (always ask, auto-approve edits, or read-only)
• Permission rules: Specific allow/deny lists for individual tools and paths

Together, these let you fine-tune Claude's behavior from fully autonomous to completely locked down, depending on your needs.

The Three Permission Modes

Claude Code has three main permission modes. Press Shift+Tab to cycle through them during a session.

Normal Mode (Default)

Claude asks for confirmation before every file edit and shell command. You see exactly what Claude wants to do and approve each action.

Use this when:

• Working on unfamiliar code
• Running commands that could have side effects
• You want to review every change before it happens

Auto-Accept Mode

Claude automatically applies file edits without asking, but still prompts before running shell commands. This speeds up editing workflows while maintaining safety for potentially destructive operations.

Use this when:

• You trust Claude's direction and want faster iteration
• Doing large refactoring tasks
• The code is version-controlled and easy to revert

Plan Mode

Claude operates in read-only mode. It can read files, search code, and analyze your project, but cannot make any changes. Perfect for exploration and planning before execution.

Use this when:

• Exploring an unfamiliar codebase
• Planning complex changes before committing to an approach
• You want Claude's analysis without any risk of modification

Setting the Default Permission Mode

You can set your preferred starting mode in settings.json:

{
  "permissions": {
    "defaultMode": "acceptEdits"
  }
}

Available values:

• "default" - Normal mode (ask for everything)
• "acceptEdits" - Auto-Accept mode
• "plan" - Plan mode (read-only)

You can also start Claude with a specific mode from the command line:

claude --permission-mode plan

Configuring Allowed and Denied Tools

Permission rules let you pre-approve safe operations and block dangerous ones. They go in your settings.json file.

Basic Structure

{
  "permissions": {
    "allow": [
      "Bash(npm run lint)",
      "Bash(npm run test *)",
      "Read(./src/**)"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(curl *)",
      "Read(./.env)"
    ],
    "ask": [
      "Bash(git push *)"
    ]
  }
}

Rule Evaluation Order

Rules are checked in this order:

1. Deny - If matched, block immediately (highest priority)
2. Ask - If matched, prompt for confirmation
3. Allow - If matched, proceed without asking

The first matching rule wins. A deny rule always takes precedence over an allow rule for the same pattern.

Permission Syntax

Available Tools

Note: Glob, Grep, LS, and AskUserQuestion do not require permissions since they have no side effects.

Real-World Permission Examples

{
  "permissions": {
    "allow": [
      "Bash(npm run *)",
      "Bash(yarn *)",
      "Bash(git status)",
      "Bash(git diff *)",
      "Bash(git log *)",
      "Bash(git add *)",
      "Bash(git commit *)",
      "Bash(* --version)",
      "Bash(* --help)"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(git push --force *)",
      "Bash(git reset --hard *)",
      "Bash(curl *)",
      "Bash(wget *)"
    ],
    "ask": [
      "Bash(git push *)"
    ]
  }
}

{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)",
      "Read(./**/credentials.json)",
      "Read(~/.aws/**)",
      "Read(~/.ssh/**)",
      "Edit(./.env)",
      "Edit(./.env.*)"
    ]
  }
}

{
  "permissions": {
    "allow": [
      "Edit(./src/**)",
      "Edit(./tests/**)"
    ],
    "deny": [
      "Edit(./package.json)",
      "Edit(./package-lock.json)",
      "Edit(./.github/**)"
    ]
  }
}

Directory Permissions

By default, Claude Code can only access files within your current working directory. To allow access to related directories:

{
  "permissions": {
    "additionalDirectories": [
      "../docs/",
      "../shared-utils/",
      "~/templates/"
    ]
  }
}

This is useful for monorepos or when you need to reference files outside the current project.

Settings File Locations

Claude Code reads settings from multiple locations, with higher precedence settings overriding lower ones:

Managed settings have the highest precedence and cannot be overridden. Use these for enforcing company-wide policies.

The Dangerous Skip Permissions Flag

Claude Code has a flag for fully autonomous operation:

claude --dangerously-skip-permissions

This bypasses all permission checks. Claude runs commands without asking, edits files automatically, and operates completely unattended.

You can disable this flag entirely for your organization:

{
  "permissions": {
    "disableBypassPermissionsMode": "disable"
  }
}

Security Best Practices

1. Start Restrictive, Open Up As Needed

Begin with Normal mode and minimal allow rules. Add permissions as you discover safe patterns in your workflow.

2. Always Deny Sensitive Files

Create deny rules for .env, credentials, API keys, and SSH keys. This protects against accidental exposure.

3. Use Project-Level Settings for Teams

Put team-agreed permissions in .claude/settings.json and commit it to git. Everyone gets the same safety rails.

4. Be Careful with Bash Wildcards

Bash patterns that constrain arguments are fragile. Bash(curl http://github.com/ *) will not match curl -X GET http://github.com/... because flags come before the URL.

5. Review Before Enabling Auto-Accept

Only use Auto-Accept mode when your code is version-controlled and you can easily revert unwanted changes.

Hooks: Automated Permission Enforcement

Claude Code supports lifecycle hooks that add another layer of control beyond static permission rules. Hooks are configured in your settings.json file and run custom scripts at key moments.

PreToolUse Hooks

PreToolUse hooks fire before Claude executes any tool. You can use them to modify tool inputs, inject additional context, or block execution entirely. This is useful for enforcing security policies automatically.

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          { "type": "command", "command": "~/.claude/hooks/validate-bash.sh" }
        ]
      }
    ]
  }
}

PostToolUse Hooks

PostToolUse hooks fire after a tool completes. Common uses include running linters after file edits and sending notifications after long operations.

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Edit",
        "hooks": [
          { "type": "command", "command": "npx prettier --write $CLAUDE_FILE_PATH" }
        ]
      }
    ]
  }
}

When to Use Each Mode

Common Mistakes

1. Overly broad allow rules: "allow": ["Bash"] allows any command. Be specific about what you are approving.
2. Forgetting deny rules for secrets: Always explicitly deny .env and credential files, even if you think you will not ask Claude about them.
3. Not using project settings: If you are on a team, share permissions via .claude/settings.json so everyone has the same safety configuration.
4. Skipping Plan Mode for complex work: When making changes that touch many files, start in Plan Mode to understand the scope before executing.
5. Using skip-permissions casually: The --dangerously-skip-permissions flag should only be used in isolated, throwaway environments.

FAQ

Can I have different permissions for different projects?

Yes. Put project-specific settings in .claude/settings.json within each project. These override your global user settings.

How do I see what permissions are active?

Run /permission in Claude Code to view current permission rules and their sources.

Do permissions apply to MCP tools?

MCP (Model Context Protocol) tools have their own permission system. Configure MCP permissions separately in your MCP server settings.

Can I reset to default permissions?

Delete your settings files and Claude Code returns to default behavior. User settings are at ~/.claude/settings.json.

What happens if allow and deny conflict?

Deny always wins. If a pattern matches both an allow and deny rule, the action is blocked.

Related Guides

• How to Use Plan Mode - deep dive into read-only analysis
• Keyboard Shortcuts in Claude Code - including Shift+Tab for mode switching
• How to Use CLAUDE.md Files - project configuration
• What Is Claude Code? - the fundamentals