Skip to main content Show chat and tutor
Tracks / Claude Code / Permissions & Safety
Permissions are the most under-configured piece of Claude Code. Too tight and you ignore every prompt. Too loose and one bad prompt nukes your laptop. Production teams in 2026 layer enterprise denylists, project allowlists, and personal local rules into a system that's fast AND safe.
Pick the right permission mode — `auto`, `acceptEdits`, `plan`, `dontAsk`, `bypassPermissions` — for any workflow Write a Bash allowlist that auto-approves safe commands without leaving security holes Understand what `--dangerously-skip-permissions` actually does and when it's appropriate (rarely) Recognize the four safety failure modes and the patterns that prevent each
Why This Matters
Permission prompts are the friction tax. Too many and you ignore them; too few and you destroy your laptop. Tuning this is critical.
The auto mode classifier (2025+) uses AI to decide what's safe, but isn't perfect — production teams use explicit allowlists for the speed-safety Pareto frontierThe 2026 update : hardened bash injection protection, .claude//.git//.vscode/ always protected even with --dangerously-skip-permissions, hook error handling improvedBuild this → Configure permissions for your workflow: allowlist common dev commands (npm, git status, pytest), denylist destructive commands (rm -rf, sudo); test Claude follows your rules What’s one thing you learned? What’s still confusing?
How was the difficulty? Easy Just Right Hard
Continue Learning Claude Code Mastery
Slash Commands & Skills
Built-in slash commands, custom commands in .claude/commands/, skills as reusable capabilities, and when each pattern wins.
Claude Code Mastery
Hooks: Deterministic Automation
Wire shell, HTTP, prompt, and agent hooks to PreToolUse, PostToolUse, SessionStart/End, and the 2026 conditional `if` field.
Claude Code Mastery
Subagents & Delegation
Define reusable specialized agents in .claude/agents/. Sub-agent vs fork, common recipes (code-reviewer, docs-writer, test-generator).
Discussion Ask questions, share insights
See AI think. Learn by watching machines learn — interactive ML visualizations from linear algebra to agents.
314 lessons
© 2026 RugvAI Labs. All rights reserved.
Interactive visualizations powered by D3.js · Three.js
Mode Behavior When to Use autoAI classifier decides; prompts on uncertainty Most interactive sessions acceptEditsAuto-approve all edit tool calls; prompt on Bash Trusted refactors, you'll review the diff planRead-only, no edits or commands Planning + analysis without changes dontAskOnly run pre-approved (allowlist) commands Strict workflows, CI, prod environments bypassPermissionsAll tool calls auto-approved DANGEROUS — automated scripts only
Set the mode at session start:
bash claude --permission-mode acceptEdits # Trust me, I'll review edits
claude --permission-mode plan # Just plan, don't touch anything
claude --permission-mode dontAsk # Strict allowlist only
# The Allowlist / Denylist Systemjson {
"permissions": {
"allow": [
"Bash(npm run *)", // any npm run X
"Bash(git status)", // exact match
"Bash(git diff *)", // any git diff variant
"Bash(pytest *)",
"Bash(python -m pytest *)"
],
"deny": [
"Bash(rm -rf *)",
"Bash(sudo *)",
"Bash(curl * | sh)",
"Bash(curl * | bash)",
"Bash(wget -O- * | sh)"
]
}
}
Pattern semantics
Exact: Bash(git status) — only matches git status exactly
Wildcard: Bash(npm run *) — matches npm run lint, npm run build, etc.
Path-scoped: Bash(rm /tmp/*) — only matches rm in /tmp
Order : deny rules win over allow rules. If both match, the command is blocked.
What auto Mode Actually Does The auto permission mode runs an AI classifier on every Bash command. The classifier categorizes:
Safe : read operations, status checks, commands that don't modify state → auto-approvedRisky : anything that modifies state → prompts userDangerous : matches deny patterns or known-bad signatures → blocked outright When you're uncertain about a command, auto is the safest default. For speed, layer an explicit allowlist on top — exact matches skip the classifier.
The --dangerously-skip-permissions Flag Sometimes called "YOLO mode". This flag bypasses permission prompts entirely — Claude can run any tool call without confirmation.
When this is appropriate
✅ Automated CI/CD with vetted prompts and a contained environment (Docker container, sandbox)
✅ Personal scripts where you've reviewed exactly what Claude will do
When this is NOT appropriate
❌ Interactive use on your laptop with sudo access
❌ Production systems
❌ When you don't fully trust the prompt source
The 2026 hardening: even with this flag, Claude Code REFUSES to touch:
.claude/ (config directory).git/ (git internals).vscode/ (editor config)node_modules/ (deletion)System paths (/etc, /usr/bin, etc.)
# Bash Injection HardeningOld vulnerability: prompt injection via tool output could trick Claude into running rm -rf if the LLM emitted a malformed Bash command.
2026 fix: Claude Code now validates Bash commands at multiple layers:
Pattern matching against the allow/deny lists (your settings.json)Lint check for shell-injection signatures ($( … ) substitutions, backticks, suspicious redirects)AI classifier in auto mode Even with --dangerously-skip-permissions, the lint layer is enforced.
# Four Safety Failure Modesplayground.py · Pyodide
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
Tests · Verify deny rules block destructive commands. Verify allow rules skip prompts. Verify unknown commands trigger the prompt in auto mode.
Five permission modes. Pick auto for interactive, acceptEdits for trusted refactors, plan for analysis-only, dontAsk for strict workflows, never bypassPermissions interactivelyAllowlist common safe commands to skip prompts — npm, pytest, git status are obvious startersDenylist destructive patterns explicitly: rm -rf, sudo, curl-piped-to-shell. Do not trust the AI classifier alone--dangerously-skip-permissions is for automated CI/CD only. Never interactively2026 hardening : protected paths (.claude/, .git/, system dirs) are always safe regardless of mode Quick Check 1 / 2
You're refactoring a 50-file change and tired of approving each Edit call. Best mode?
A acceptEdits — auto-approve edits, but still prompt on Bash (so destructive shell commands aren't silent) B bypassPermissions — speed C plan — just analyze D dontAsk — strict allowlist
Check Answer
Quick check
Which command line is appropriate for a long, trusted refactor on a feature branch you've already reviewed the plan for?
A `claude --dangerously-skip-permissions` B `claude --permission-mode acceptEdits` C `claude --permission-mode plan` D `sudo claude`
Nice work! You just learned the five permission modes and how to layer allow/deny/protected paths for safety without losing speed.
Progress 6 of 17 lessons to Python fluency
Up next: custom slash commands and skills — your project's speed multipliers
With permissions tuned, you're safe to move fast. Next: slash commands and skills — the speed multipliers.