Permissions & Safety

Permissions are the most under-configured piece of Claude Code. Too tight and you ignore every prompt. Too loose and one bad prompt nukes your laptop. Production teams in 2026 layer enterprise denylists, project allowlists, and personal local rules into a system that's fast AND safe.

Learning Objectives

After this lesson, you will be able to:

Pick the right permission mode — `auto`, `acceptEdits`, `plan`, `dontAsk`, `bypassPermissions` — for any workflow
Write a Bash allowlist that auto-approves safe commands without leaving security holes
Understand what `--dangerously-skip-permissions` actually does and when it's appropriate (rarely)
Recognize the four safety failure modes and the patterns that prevent each

Prerequisites

Before You Start

Review

#The Five Permission Modes

Mode	Behavior	When to Use
`auto` (default)	AI classifier decides; prompts on uncertainty	Most interactive sessions
`acceptEdits`	Auto-approve all edit tool calls; prompt on Bash	Trusted refactors, you'll review the diff
`plan`	Read-only, no edits or commands	Planning + analysis without changes
`dontAsk`	Only run pre-approved (allowlist) commands	Strict workflows, CI, prod environments
`bypassPermissions`	All tool calls auto-approved	DANGEROUS — automated scripts only

Set the mode at session start:

bash

claude --permission-mode acceptEdits  # Trust me, I'll review edits
claude --permission-mode plan          # Just plan, don't touch anything
claude --permission-mode dontAsk       # Strict allowlist only

Or change mid-session:

> /mode acceptEdits

#The Allowlist / Denylist System

json

{
  "permissions": {
    "allow": [
      "Bash(npm run *)",          // any npm run X
      "Bash(git status)",         // exact match
      "Bash(git diff *)",         // any git diff variant
      "Bash(pytest *)",
      "Bash(python -m pytest *)"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(sudo *)",
      "Bash(curl * | sh)",
      "Bash(curl * | bash)",
      "Bash(wget -O- * | sh)"
    ]
  }
}

Pattern semantics

Exact: Bash(git status) — only matches git status exactly
Wildcard: Bash(npm run *) — matches npm run lint, npm run build, etc.
Path-scoped: Bash(rm /tmp/*) — only matches rm in /tmp

Order: deny rules win over allow rules. If both match, the command is blocked.

What `auto` Mode Actually Does

The auto permission mode runs an AI classifier on every Bash command. The classifier categorizes:

Safe: read operations, status checks, commands that don't modify state → auto-approved
Risky: anything that modifies state → prompts user
Dangerous: matches deny patterns or known-bad signatures → blocked outright

When you're uncertain about a command, auto is the safest default. For speed, layer an explicit allowlist on top — exact matches skip the classifier.

The `--dangerously-skip-permissions` Flag

Sometimes called "YOLO mode". This flag bypasses permission prompts entirely — Claude can run any tool call without confirmation.

When this is appropriate

✅ Automated CI/CD with vetted prompts and a contained environment (Docker container, sandbox)
✅ Personal scripts where you've reviewed exactly what Claude will do

When this is NOT appropriate

❌ Interactive use on your laptop with sudo access
❌ Production systems
❌ When you don't fully trust the prompt source

The 2026 hardening: even with this flag, Claude Code REFUSES to touch:

.claude/ (config directory)
.git/ (git internals)
.vscode/ (editor config)
node_modules/ (deletion)
System paths (/etc, /usr/bin, etc.)

#Bash Injection Hardening

Old vulnerability: prompt injection via tool output could trick Claude into running rm -rf if the LLM emitted a malformed Bash command.

2026 fix: Claude Code now validates Bash commands at multiple layers:

Pattern matching against the allow/deny lists (your settings.json)
Lint check for shell-injection signatures ($( … ) substitutions, backticks, suspicious redirects)
AI classifier in auto mode

Even with --dangerously-skip-permissions, the lint layer is enforced.

#Four Safety Failure Modes

#Hands-On

pythonplayground.py · Pyodide

// .claude/settings.json — production-grade permissions
// Optimized for: web/Python project with strict safety
{
"permissions": {
  "allow": [
    // Read-only commands (always safe)
    "Bash(git status)",
    "Bash(git diff *)",
    "Bash(git log *)",
    "Bash(git branch *)",
    "Bash(ls *)",
    "Bash(cat *)",
    "Bash(grep *)",
    "Bash(find . *)",
    "Bash(pwd)",
    "Bash(which *)",
    
    // Build/test commands (state-changing but safe in this project)
    "Bash(npm install)",
    "Bash(npm install --save-dev *)",
    "Bash(npm run *)",
    "Bash(npx tsc *)",
    "Bash(npx eslint *)",
    "Bash(pytest *)",
    "Bash(python -m pytest *)",
    "Bash(python -m pip install *)",
    
    // Git operations (intentional change)
    "Bash(git checkout *)",
    "Bash(git switch *)",
    "Bash(git pull *)",
    "Bash(git fetch *)"
  ],
  "deny": [
    // Destruction
    "Bash(rm -rf *)",
    "Bash(rm -fr *)",
    
    // Privilege escalation
    "Bash(sudo *)",
    "Bash(su *)",
    
    // Curl-piped-to-shell (classic supply chain attack)
    "Bash(curl * | sh)",
    "Bash(curl * | bash)",
    "Bash(wget * | sh)",
    "Bash(wget -O- * | sh)",
    
    // Force-push to main (destructive on shared branch)
    "Bash(git push --force * main)",
    "Bash(git push --force * master)",
    "Bash(git push -f * main)",
    
    // SSH config / system paths
    "Bash(rm * .ssh/*)",
    "Bash(* > /etc/*)",
    
    // Network downloads to sketchy paths
    "Bash(curl * -o /tmp/*.sh && bash /tmp/*.sh)"
  ]
}
}

// Test the rules:
// claude
// > Run `git status`         → auto-approved (allow)
// > Run `npm install foo`    → prompts (not in allow, not denied) — auto mode
// > Run `rm -rf /tmp/test`   → BLOCKED (deny)
// > Run `sudo apt update`    → BLOCKED (deny)

Tests · Verify deny rules block destructive commands. Verify allow rules skip prompts. Verify unknown commands trigger the prompt in auto mode.

#Key Takeaways

Five permission modes. Pick auto for interactive, acceptEdits for trusted refactors, plan for analysis-only, dontAsk for strict workflows, never bypassPermissions interactively
Allowlist common safe commands to skip prompts — npm, pytest, git status are obvious starters
Denylist destructive patterns explicitly: rm -rf, sudo, curl-piped-to-shell. Do not trust the AI classifier alone
--dangerously-skip-permissions is for automated CI/CD only. Never interactively
2026 hardening: protected paths (.claude/, .git/, system dirs) are always safe regardless of mode

#Quick Check

Quick Check1 / 2

You're refactoring a 50-file change and tired of approving each Edit call. Best mode?

Quick check

Which command line is appropriate for a long, trusted refactor on a feature branch you've already reviewed the plan for?

With permissions tuned, you're safe to move fast. Next: slash commands and skills — the speed multipliers.

Permissions & Safety

Learning Objectives

After this lesson, you will be able to:

Pick the right permission mode — `auto`, `acceptEdits`, `plan`, `dontAsk`, `bypassPermissions` — for any workflow
Write a Bash allowlist that auto-approves safe commands without leaving security holes
Understand what `--dangerously-skip-permissions` actually does and when it's appropriate (rarely)
Recognize the four safety failure modes and the patterns that prevent each

Prerequisites

Before You Start

Review

#The Five Permission Modes

Mode	Behavior	When to Use
`auto` (default)	AI classifier decides; prompts on uncertainty	Most interactive sessions
`acceptEdits`	Auto-approve all edit tool calls; prompt on Bash	Trusted refactors, you'll review the diff
`plan`	Read-only, no edits or commands	Planning + analysis without changes
`dontAsk`	Only run pre-approved (allowlist) commands	Strict workflows, CI, prod environments
`bypassPermissions`	All tool calls auto-approved	DANGEROUS — automated scripts only

Set the mode at session start:

bash

claude --permission-mode acceptEdits  # Trust me, I'll review edits
claude --permission-mode plan          # Just plan, don't touch anything
claude --permission-mode dontAsk       # Strict allowlist only

Or change mid-session:

> /mode acceptEdits

#The Allowlist / Denylist System

json

{
  "permissions": {
    "allow": [
      "Bash(npm run *)",          // any npm run X
      "Bash(git status)",         // exact match
      "Bash(git diff *)",         // any git diff variant
      "Bash(pytest *)",
      "Bash(python -m pytest *)"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(sudo *)",
      "Bash(curl * | sh)",
      "Bash(curl * | bash)",
      "Bash(wget -O- * | sh)"
    ]
  }
}

Pattern semantics

Exact: Bash(git status) — only matches git status exactly
Wildcard: Bash(npm run *) — matches npm run lint, npm run build, etc.
Path-scoped: Bash(rm /tmp/*) — only matches rm in /tmp

Order: deny rules win over allow rules. If both match, the command is blocked.

What `auto` Mode Actually Does

The auto permission mode runs an AI classifier on every Bash command. The classifier categorizes:

Safe: read operations, status checks, commands that don't modify state → auto-approved
Risky: anything that modifies state → prompts user
Dangerous: matches deny patterns or known-bad signatures → blocked outright

When you're uncertain about a command, auto is the safest default. For speed, layer an explicit allowlist on top — exact matches skip the classifier.

The `--dangerously-skip-permissions` Flag

Sometimes called "YOLO mode". This flag bypasses permission prompts entirely — Claude can run any tool call without confirmation.

When this is appropriate

✅ Automated CI/CD with vetted prompts and a contained environment (Docker container, sandbox)
✅ Personal scripts where you've reviewed exactly what Claude will do

When this is NOT appropriate

❌ Interactive use on your laptop with sudo access
❌ Production systems
❌ When you don't fully trust the prompt source

The 2026 hardening: even with this flag, Claude Code REFUSES to touch:

.claude/ (config directory)
.git/ (git internals)
.vscode/ (editor config)
node_modules/ (deletion)
System paths (/etc, /usr/bin, etc.)

#Bash Injection Hardening

Old vulnerability: prompt injection via tool output could trick Claude into running rm -rf if the LLM emitted a malformed Bash command.

2026 fix: Claude Code now validates Bash commands at multiple layers:

Pattern matching against the allow/deny lists (your settings.json)
Lint check for shell-injection signatures ($( … ) substitutions, backticks, suspicious redirects)
AI classifier in auto mode

Even with --dangerously-skip-permissions, the lint layer is enforced.

#Four Safety Failure Modes

#Hands-On

pythonplayground.py · Pyodide

Tests · Verify deny rules block destructive commands. Verify allow rules skip prompts. Verify unknown commands trigger the prompt in auto mode.

#Key Takeaways

Five permission modes. Pick auto for interactive, acceptEdits for trusted refactors, plan for analysis-only, dontAsk for strict workflows, never bypassPermissions interactively
Allowlist common safe commands to skip prompts — npm, pytest, git status are obvious starters
Denylist destructive patterns explicitly: rm -rf, sudo, curl-piped-to-shell. Do not trust the AI classifier alone
--dangerously-skip-permissions is for automated CI/CD only. Never interactively
2026 hardening: protected paths (.claude/, .git/, system dirs) are always safe regardless of mode

#Quick Check

Quick Check1 / 2

You're refactoring a 50-file change and tired of approving each Edit call. Best mode?

Quick check

Which command line is appropriate for a long, trusted refactor on a feature branch you've already reviewed the plan for?

With permissions tuned, you're safe to move fast. Next: slash commands and skills — the speed multipliers.

Permissions & Safety

After this lesson, you will be able to:

Before You Start

#The Five Permission Modes

#The Allowlist / Denylist System

Pattern semantics

What `auto` Mode Actually Does

The `--dangerously-skip-permissions` Flag

When this is appropriate

When this is NOT appropriate

#Bash Injection Hardening

#Four Safety Failure Modes

#Hands-On

#Key Takeaways

#Quick Check

Your Reflection

Continue Learning

Discussion

Permissions & Safety

After this lesson, you will be able to:

Before You Start

#The Five Permission Modes

#The Allowlist / Denylist System

Pattern semantics

What `auto` Mode Actually Does

The `--dangerously-skip-permissions` Flag

When this is appropriate

When this is NOT appropriate

#Bash Injection Hardening

#Four Safety Failure Modes

#Hands-On

#Key Takeaways

#Quick Check

Your Reflection

Continue Learning

Discussion

Permissions & Safety

#The Five Permission Modes

#The Allowlist / Denylist System

Pattern semantics

What auto Mode Actually Does

The --dangerously-skip-permissions Flag

When this is appropriate

When this is NOT appropriate

#Bash Injection Hardening

#Four Safety Failure Modes

#Hands-On

#Key Takeaways

#Quick Check

Your Reflection

Continue Learning

Discussion

Permissions & Safety

#The Five Permission Modes

#The Allowlist / Denylist System

Pattern semantics

What auto Mode Actually Does

The --dangerously-skip-permissions Flag

When this is appropriate

When this is NOT appropriate

#Bash Injection Hardening

#Four Safety Failure Modes

#Hands-On

#Key Takeaways

#Quick Check

Your Reflection

Continue Learning

Discussion

What `auto` Mode Actually Does

The `--dangerously-skip-permissions` Flag

What `auto` Mode Actually Does

The `--dangerously-skip-permissions` Flag