Claude Code permissions in settings.json: allow, ask, deny and modes

To make dangerous Claude Code tools need approval: run in Manual mode (default), add permissions.ask (and deny) rules for high-risk patterns such as Bash(git push *) or Bash(rm *), and optionally set managed disableBypassPermissionsMode: "disable". Content-scoped ask rules still prompt in auto mode before the classifier. Leaving auto entirely has its own guide; why prompts fire on readonly/git-shaped actions is another guide.

Pick a permission mode that expects approval

Switch mid-session: CLI/JetBrains Shift+Tab, VS Code mode indicator, Desktop mode selector. Persist Manual:

claude --permission-mode default

Or in user settings (~/.claude/settings.json):

{
  "permissions": {
    "defaultMode": "default"
  }
}

manual is an alias for default from v2.1.200+. Project .claude/settings.json / .claude/settings.local.json: starting auto and bypassPermissions do not take effect.

From 2.1.283, interactive terminal and VS Code start in auto when no permission mode is configured, on every plan and provider; permissions.defaultMode still overrides (permission modes docs). The CHANGELOG lists the change under 2.1.284, so run 2.1.284 or later if you want to be sure (Claude Sonnet 5.5). Full leave-auto steps (Shift+Tab essay, org disableAutoMode walkthrough) live in the auto-mode guide.

Force approval with ask / deny rules

Open /permissions to view and edit rules and see which settings.json each rule comes from. Rules evaluate deny → ask → allow; first match wins. An allow rule cannot carve an exception out of a deny.

Example pattern for approval on push/rm while hard-blocking force-push:

{
  "permissions": {
    "defaultMode": "default",
    "ask": [
      "Bash(git push *)",
      "Bash(gh pr create *)",
      "Bash(rm *)"
    ],
    "deny": [
      "Bash(git push --force *)"
    ]
  }
}

In auto mode, content-scoped ask rules (for example Bash(git push *)) still force a prompt before the classifier. You can stay in auto for routine work and still gate named danger. MCP tools use mcp__server / mcp__server__tool forms the same way.

Honest limit (docs, “What a Bash rule doesn’t match”): Bash rules match the command text Claude writes after split/wrappers, not an OS security boundary. Bash(rm *) stops rm -rf build/ but not /bin/rm … or bash -c 'rm …'. Pair with sandboxing and/or PreToolUse hooks (set to fail closed so a crashed hook can't wave commands through) when the restriction must hold. Why some readonly/git prompts still appear: readonly-git guide.

Org locks + dangerous-rm notes (2.1.281)

{
  "permissions": {
    "disableBypassPermissionsMode": "disable"
  }
}

Blocks bypass / --dangerously-skip-permissions. Works from any scope; typically managed. Optional: "disableAutoMode": "disable" removes auto from the cycle; --permission-mode auto starts Manual instead.

Docs Critical paths: rm / rmdir targeting a critical path are never auto-approved via an allow rule or a PreToolUse "allow"; mode decides ask / classifier / deny. Even bypassPermissions still asks on those removals.

CHANGELOG 2.1.281 (still accurate after 2.1.284 HEAD): Desktop/gateway desktop policy keys include disableBypassPermissionsMode. Recursive rm whose target is only command-substitution output (e.g. rm -rf "$(pwd)") now asks even with a Bash allow in auto / --dangerously-skip-permissions. Dangerous-rm prompt there waits 2 minutes, then denies with a rewrite hint; the check also flags shell-variable + top-level dir cases. Shift+Tab double-press no longer lands on the wrong mode. Opt-out envs exist in CHANGELOG (not the default recommendation). Do not treat CLAUDE_CODE_AUTO_MODE_SERVER as approval config (it routes the classifier).

Pitfalls

• Using bypass / --dangerously-skip-permissions for “more control”: that removes prompts (isolated envs only).
• Expecting project defaultMode: "auto" / bypass to stick as starting mode.
• Assuming you still start in Manual on Enterprise / Bedrock / gateway after 2.1.283 without setting defaultMode.
• Thinking Bash(rm *) covers /usr/bin/rm or nested bash -c.
• Treating CLAUDE_CODE_AUTO_MODE_SERVER=0 as approval config.

Related: parallel agents.

FAQ

What’s the fastest way to require approval for most tools?

Manual mode: Shift+Tab to Manual, or "defaultMode": "default" in ~/.claude/settings.json / claude --permission-mode default.

Can I stay in auto but still approve git push?

Yes. Add Bash(git push *) under permissions.ask. Ask evaluates before the classifier.

How do I block bypass permissions for the org?

Set "permissions": { "disableBypassPermissionsMode": "disable" } (typically in managed settings).

Is this the same as stopping auto mode?

No. This guide configures modes + ask/deny so dangerous tools need approval. Leaving auto for routine confirmation: stop auto mode guide.

Why does Claude still ask on some git/read actions?

Rules, mode, and tool type interact (including built-in readonly sets and regressions fixed in later versions). See why readonly/git prompts.

Sources

Checked 2026-09-29.

• Choose a permission mode: modes table; Manual/default; Shift+Tab; defaultMode; disableAutoMode; critical paths; ask-before-classifier
• Configure permissions: ask/deny/allow; evaluation order deny→ask→allow; Bash honesty limits; disableBypassPermissionsMode
• CHANGELOG: ## 2.1.284 (interactive/VS Code start in auto when no mode configured; the permission modes docs give v2.1.283); ## 2.1.281 (disableBypassPermissionsMode desktop/gateway keys; substitution-target rm prompt; 2-min dangerous-rm timeout; Shift+Tab double-press)
• Claude Sonnet 5.5: default Sonnet change + 2.1.284 auto-start
• Supporting: Settings · related: leave auto · readonly git