Permission decision tree · Anthropic docs checked Nov 3, 2026
Choose Claude Code permission rules by user and project
Choose the Claude Code settings file for your user, project, or organization, then configure and verify narrow allow, ask, and deny rules.
Which Claude Code settings file should I use?
Use managed settings for organization policy, `.claude/settings.json` for reviewed rules shared with a project, `.claude/settings.local.json` for your own project-only settings or a trial, and `~/.claude/settings.json` for your user settings across projects. Managed policy and settings precedence can affect the result; check `/status` and the current Anthropic settings guide.
What is the difference between allow, ask, and deny?
Allow lets a matching tool action run without manual approval, ask requires confirmation, and deny blocks a matching action. Claude Code evaluates deny before ask before allow, so an allow rule cannot override a matching deny. Verify the exact matching behavior in the official permission guide.
Should I change the permission mode?
Start with the default mode unless a documented mode matches your broader workflow. Modes such as Plan, `acceptEdits`, `dontAsk`, Auto, and `bypassPermissions` change behavior beyond one rule; review their current descriptions and cautions before using one.
How do I check that a permission rule works?
Try a narrow local rule, inspect `/status` and `/permissions`, then test both the intended action and a nearby action that should not match. Check the diff before moving a tested rule into the shared project settings file. This validates your setup; it does not constitute a security audit.
When were the Claude Code permission details checked?
Anthropic’s settings and permissions documentation was checked on November 3, 2026. Product behavior and documentation can change, so use the linked official pages to confirm current behavior for your installed version.