Claude Code permissions: six modes, one rule order, one short file

Modes set the baseline and rules sit on top. Claude Code checks rules in the order deny, ask, allow, and the first match decides. Specificity doesn't change the order.

That has one consequence people miss. A broad deny such as Bash(aws *) blocks every matching call, even one that also matches a narrower allow such as Bash(aws s3 ls). An allow rule can't carve an exception out of a deny rule, and a matching ask rule prompts even when a more specific allow also matches. Deny rules apply in every mode, bypassPermissions included, and allow rules have no effect in bypassPermissions.

Two more details. A bare tool name in a deny rule, Bash for instance, removes the tool from Claude's context entirely, while a scoped rule like Bash(rm *) leaves the tool and blocks matching calls. And Claude Code enforces rules itself. A line in CLAUDE.md or your prompt changes what Claude tries, and it doesn't change what Claude Code allows. Run /permissions to list every rule and the settings file it came from, per the permissions page.

Save this as .claude/settings.json at the root of a repository and commit it. It denies the reads and the delete that Anthropic's documentation uses as examples, and it switches bypass mode off.

% cat .claude/settings.json
{
  "permissions": {
    "deny": ["Read(./.env)", "Read(./secrets/**)", "Bash(rm *)"],
    "disableBypassPermissionsMode": "disable"
  }
}

Deny rules are checked first, so a broad allow rule in a user or project file can't reopen those paths. A .claudeignore file is not a substitute. Anthropic says plainly that it has no effect, so move its entries into Read deny rules. The disable key works from any settings file, and the same key in managed settings is the version developers can't undo.

We ran these commands on 28 October 2026 with Claude Code 2.1.274 on a Mac, in a throwaway folder with an empty home directory. /permissions is an interactive screen, and anything that sends a prompt spends plan usage, so we skipped both. The commands below read Claude Code's own validation and defaults, which need no account.

% claude --version
2.1.274 (Claude Code)

% claude --permission-mode nope -p hello
error: option '--permission-mode <mode>' argument 'nope' is invalid. Allowed choices are acceptEdits, auto, bypassPermissions, manual, dontAsk, plan.
exit 1

The flag rejects an unknown mode before anything else happens and lists the six values from the table above, with manual as an alias for default.

% claude auto-mode defaults | jq -c 'map_values(length)'
{"allow":17,"soft_deny":70,"hard_deny":1,"environment":21}

% claude auto-mode defaults | jq -r '.hard_deny[0] | split(":")[0]'
Data Exfiltration

The classifier's default rule set holds 17 allow rules, 70 soft-deny rules and 1 hard-deny rule, with 21 environment lines. The one hard-deny rule is named Data Exfiltration. Next, a settings file with a bad mode value in a second folder. claude doctor, trimmed to its Invalid settings section with the working folder replaced by a dot, caught it, and it found nothing wrong with the short file above.

% claude doctor
Invalid settings
- ./.claude/settings.json › permissions.defaultMode: Invalid value. Expected one of: "acceptEdits", "auto", "bypassPermissions", "default", "dontAsk", "plan"
  Suggested fix: Valid modes: "acceptEdits" (ask before file changes), "plan" (analysis only), "bypassPermissions" (auto-accept all), or "default" (standard behavior)

% claude doctor | grep -c "Invalid settings"
0

Documentation versions run ahead of this machine. Anthropic's pages describe up to 2.1.302, and 2.1.274 is installed, so a mode default described above may differ locally.