KERNEL

PERMISSIONS

Which tools run without asking.

Every tool (Bash, Edit, Write, MCP) can be allowed, denied or asked. Defined by command pattern. E.g. Bash(git status:*) frees only status, not push.

Move to user settings what is universally safe (ls, git diff, npm test). Move to project settings what is repo-specific (npm run convex:deploy only in this project).

Never free the whole Bash(*). You lose the seat belt and still feel comfortable.

In practice

// .claude/settings.local.json
{
  "permissions": {
    "allow": [
      "Bash(git status:*)",
      "Bash(git diff:*)",
      "Bash(npm test:*)",
      "Read(*)"
    ],
    "deny": [
      "Bash(rm -rf:*)",
      "Bash(git push --force:*)"
    ]
  }
}

Related practices

This practice is part of Claude Code OS, the full blueprint of the practices that separate following a tutorial from actually working with Claude. Ler em português.