Permissions Configuration Starter

When to use this

Once you are approving prompts without reading them, permissions have stopped protecting you. The fix is to auto-approve the genuinely safe things so that a prompt appearing again means something.

Save at .claude/settings.json for a project, or ~/.claude/settings.json for all projects.

The template

{
  "permissions": {
    "allow": [
      "Bash(git status)",
      "Bash(git diff:*)",
      "Bash(git log:*)",
      "Bash(git branch)",
      "Bash(git show:*)",
      "Bash(ls:*)",
      "Bash(cat:*)",
      "Bash(rg:*)",
      "Bash(npm test:*)",
      "Bash(npm run lint:*)",
      "Bash(npm run typecheck:*)",
      "Bash(npm run build:*)",
      "Read(*)"
    ],
    "deny": [
      "Bash(rm -rf:*)",
      "Bash(git push --force:*)",
      "Bash(git reset --hard:*)",
      "Bash(sudo:*)",
      "Bash(curl:* | sh)",
      "Bash(npm publish:*)",
      "Bash(docker system prune:*)",
      "Read(.env)",
      "Read(.env.*)",
      "Read(**/*.pem)",
      "Read(**/id_rsa*)"
    ]
  }
}

What to change

Replace the npm commands with whatever your project uses.

Add your own safe read only commands to the allow list. The test is simple: if running it a hundred times changes nothing, it is safe to auto-approve.

Add anything project specific and destructive to the deny list. A deploy script, a migration command, a data import.

The reasoning

Allow reads and tests. These cannot damage anything and they are what the agent does most. Approving them one at a time trains you to click yes without reading.

Deny the unrecoverable. Force push, hard reset, recursive delete, and sudo. These are not "ask me", they are "no". You can always run one yourself if you genuinely need it.

Deny reading secrets. .env files, private keys, and credentials should not be in the agent's context at all. Once a secret is in context it goes to your model provider, and it may end up in logs.

Leave everything else to prompt. Writes, installs, network calls, and anything unrecognised. That is the point: a prompt should mean "this is worth a second of thought".

A caution

A deny rule matching a command string is not a security boundary. An agent can reach the same outcome by a different route, and these rules are pattern matching, not sandboxing. Treat them as a guard against mistakes, not against a determined adversary. For real isolation, run the agent in a container or a VM.