{"id":5299,"date":"2026-09-18T01:40:05","date_gmt":"2026-09-18T04:40:05","guid":{"rendered":"https:\/\/tucumandevelopers.com\/index.php\/2026\/09\/18\/permissions-tool-allowlisting-in-claude-code-a-beginners-guide\/"},"modified":"2026-09-18T01:40:05","modified_gmt":"2026-09-18T04:40:05","slug":"permissions-tool-allowlisting-in-claude-code-a-beginners-guide","status":"publish","type":"post","link":"https:\/\/tucumandevelopers.com\/index.php\/2026\/09\/18\/permissions-tool-allowlisting-in-claude-code-a-beginners-guide\/","title":{"rendered":"Permissions &#038; Tool Allowlisting in Claude Code: A Beginner&#8217;s Guide"},"content":{"rendered":"<div>\n<div>\n<div data-article-id=\"4678359\" id=\"article-body\">\n<h2> <a name=\"the-scenario\" href=\"#the-scenario\"> <\/a> The Scenario <\/h2>\n<p>Remember the setup from the <a href=\"https:\/\/dev.to\/alimurrazi\/agents-and-skills-in-claude-code-a-beginners-guide-24hk\">first article<\/a> \u2014 a project with <code>CLAUDE.md<\/code>, an <code>api-conventions<\/code> skill, and a <code>code-reviewer<\/code> subagent, all working together to keep new API endpoints consistent? Same project. But Claude Code doesn&#8217;t only touch files \u2014 it can also run terminal commands and, if you&#8217;ve connected one, query your actual database.<\/p>\n<p>So now picture this: mid-session, Claude decides the fix for a bug is to push the branch straight to remote before you&#8217;ve looked at it. Or it runs a &#8220;quick&#8221; database command to test something, and that command is a <code>DROP<\/code>. Nothing in the skill or the subagent stops either of those \u2014 they only cover <em>how<\/em> code should look and <em>who<\/em> reviews it. Neither one ever asked <em>&#8220;should this specific action be allowed to happen at all?&#8221;<\/em><\/p>\n<p>That question is what permissions answer.<\/p>\n<h2> <a name=\"permission-in-one-sentence\" href=\"#permission-in-one-sentence\"> <\/a> Permission, in One Sentence <\/h2>\n<p>A permission is a <strong>gate<\/strong>: before Claude runs a tool call, a rule decides whether it&#8217;s allowed, denied, or needs your OK first. It&#8217;s not reasoning about risk \u2014 it&#8217;s checking a pattern you wrote in advance.<\/p>\n<p><a href=\"https:\/\/media2.dev.to\/dynamic\/image\/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto\/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fugaufxx8f9e6fi0syadn.jpg\"><\/a><\/p>\n<h2> <a name=\"three-outcomes\" href=\"#three-outcomes\"> <\/a> Three Outcomes <\/h2>\n<p>Every tool call lands in one of three buckets:<\/p>\n<ul>\n<li> <strong>Allow<\/strong> \u2192 runs instantly, no prompt<\/li>\n<li> <strong>Ask<\/strong> \u2192 pauses, waits for you to say yes<\/li>\n<li> <strong>Deny<\/strong> \u2192 blocked, full stop<\/li>\n<\/ul>\n<h2> <a name=\"back-to-the-scenario-one-real-example\" href=\"#back-to-the-scenario-one-real-example\"> <\/a> Back to the Scenario: One Real Example <\/h2>\n<p>Permission rules live in <code>.claude\/settings.json<\/code>, right alongside the skill and subagent files from the first article: <\/p>\n<div>\n<pre><code>your-project\/ \u251c\u2500\u2500 CLAUDE.md \u251c\u2500\u2500 .claude\/ \u2502 \u251c\u2500\u2500 settings.json \u2190 permission rules go here \u2502 \u251c\u2500\u2500 skills\/ \u2502 \u2514\u2500\u2500 agents\/ \u2514\u2500\u2500 src\/ <\/code><\/pre>\n<div>\n<\/p><\/div>\n<\/p><\/div>\n<p>Commit that file to the repo, and the project can share the same permission configuration across the team.<\/p>\n<p>Here&#8217;s a rule set that directly stops both close calls from the opening \u2014 one rule per tool, so you can see this isn&#8217;t just a Bash thing: <\/p>\n<div>\n<pre><code><span>{<\/span><span> <\/span><span>\"permissions\"<\/span><span>:<\/span><span> <\/span><span>{<\/span><span> <\/span><span>\"allow\"<\/span><span>:<\/span><span> <\/span><span>[<\/span><span>\"Bash(git *)\"<\/span><span>],<\/span><span> <\/span><span>\"ask\"<\/span><span>:<\/span><span> <\/span><span>[<\/span><span>\"Bash(git push *)\"<\/span><span>],<\/span><span> <\/span><span>\"deny\"<\/span><span>:<\/span><span> <\/span><span>[<\/span><span>\"Database(DROP *)\"<\/span><span>]<\/span><span> <\/span><span>}<\/span><span> <\/span><span>}<\/span><span> <\/span><\/code><\/pre>\n<div>\n<\/p><\/div>\n<\/p><\/div>\n<ul>\n<li> <code>git status<\/code>, <code>git diff<\/code> \u2192 <strong>allowed<\/strong>, they&#8217;re harmless<\/li>\n<li> <code>git push<\/code> \u2192 <strong>asks first<\/strong> \u2014 the more specific <code>git push<\/code> rule takes precedence over the broader <code>git *<\/code> rule<\/li>\n<li>Any <code>DROP<\/code> query against the database, through whatever tool gives Claude that access \u2192 <strong>denied<\/strong>, no exceptions<\/li>\n<\/ul>\n<p>Two different tools, same three-outcome idea. Once you understand the pattern, you can use the same allow\/ask\/deny idea across the tools Claude Code can use.<\/p>\n<p><a href=\"https:\/\/media2.dev.to\/dynamic\/image\/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto\/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fqkn91sjbm3glkxse5jdd.png\"><\/a><\/p>\n<p>The same rules aren&#8217;t only useful for teams, either \u2014 they also protect <em>you<\/em>, three hours into a solo debugging session, from your own tired typo turning into a dropped table.<\/p>\n<h2> <a name=\"the-tradeoff\" href=\"#the-tradeoff\"> <\/a> The Trade-off <\/h2>\n<p>More &#8220;ask&#8221; rules \u2260 more safety. If Claude asks about everything, you stop reading the prompts and just click yes \u2014 and now the gate isn&#8217;t protecting anything.<\/p>\n<p><a href=\"https:\/\/media2.dev.to\/dynamic\/image\/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto\/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Ft9zy1d5khb67e4cppe6f.gif\"><\/a><\/p>\n<p><strong>A permission only helps if someone actually reads it.<\/strong><\/p>\n<h2> <a name=\"takeaways\" href=\"#takeaways\"> <\/a> Takeaways <\/h2>\n<ul>\n<li>Permission = a gate checked before a tool call runs, not a reasoning step.<\/li>\n<li>Three outcomes \u2014 allow, ask, deny \u2014 and they apply across every tool Claude has, not just Bash.<\/li>\n<li>A narrow, specific rule (like blocking just <code>DROP<\/code> on the database) can coexist with a broad allow on everything else.<\/li>\n<li>Useful for trusting a teammate less <em>and<\/em> for catching your own mistakes.<\/li>\n<\/ul>\n<hr><\/div>\n<\/div>\n<\/div>\n<\/div>\n<p>Fuente: <a href=\"https:\/\/dev.to\/alimurrazi\/permissions-tool-allowlisting-in-claude-code-a-beginners-guide-592i\">Art\u00edculo original<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Scenario Remember the setup from the first article \u2014 a project with CLAUDE.md, an api-conventions skill, and a code-reviewer subagent, all working together to keep new API endpoints consistent? Same project. But Claude Code doesn&#8217;t only touch files \u2014 it can also run terminal commands and, if you&#8217;ve connected one, query your actual database. [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":5298,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"webixso_pending_account_ids":""},"categories":[41],"tags":[],"class_list":["post-5299","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devto"],"jetpack_publicize_connections":[],"_links":{"self":[{"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/posts\/5299","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/comments?post=5299"}],"version-history":[{"count":0,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/posts\/5299\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/media\/5298"}],"wp:attachment":[{"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/media?parent=5299"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/categories?post=5299"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/tags?post=5299"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}