How to control what Claude Code can do on your computer

Claude Code is an AI tool that can read files and run commands on a developer's computer. What it is allowed to do without asking is controlled in a settings file called settings.json. Three independent guides from Developers Digest, Claudefolio and Fast.io walk through how it works. Anthropic's own documentation was not used, so the details should be checked against it.

Three lists and a fixed order

According to Developers Digest, there are three rule lists: allow runs without asking, ask always requests confirmation, and deny blocks outright. Claudefolio writes that rules are evaluated in the order deny, ask, allow, and that the first match wins. A deny rule can therefore never be overridden by an allow rule.

Fast.io points out one consequence: A broad deny rule such as Bash(aws *) also blocks calls that would otherwise match a narrow allow rule such as Bash(aws s3 ls). Actions with no matching rule are decided by the defaultMode setting.

A rule is written as a tool name with an optional pattern in parentheses, for example Bash(npm run test *) or WebFetch(domain:github.com). The space before the asterisk matters: According to Claudefolio, Bash(ls *) matches the command ls -la but not lsof, while Bash(ls*) matches both. Compound commands using && or | are split up, and each part must match a rule on its own, Fast.io writes.

Several places to put settings

Claudefolio lists several layers: the organization's managed settings, command-line arguments, local project settings (.claude/settings.local.json), shared project settings (.claude/settings.json) and user settings (~/.claude/settings.json). The managed settings have the highest priority and cannot be loosened by developers or projects. Fast.io mentions only three scopes, so the guides do not fully agree, and the order between the layers has not been verified.

In practice, Claudefolio suggests putting the team's shared rules in the shared project file, personal defaults in the user file and one-off adjustments in the local file.

Modes and dangerous shortcuts

Fast.io describes six permission modes, including default (asks before most actions), plan (read-only exploration), dontAsk (rejects anything not pre-approved) and bypassPermissions (skips prompts, only for isolated environments).

According to Developers Digest, setting defaultMode to auto or bypassPermissions in a project's shared .claude/settings.json has no effect. It must be set in the user settings instead. The --dangerously-skip-permissions flag should only be used in sandboxes with no credentials or network access. Developers Digest recommends a good allow list over skipping the prompts.

Protect secrets

According to Developers Digest, deny rules for files such as .env and .pem keep credentials out of the model's context. According to Claudefolio, certain paths such as .git and .bashrc always require approval, except in bypassPermissions.

Claudefolio also highlights hooks, which are commands that run on fixed events regardless of what the tool decides. According to Claudefolio, they are more reliable than instructions in CLAUDE.md, which are only advisory.

Fast.io claims that developers approve 93 percent of prompts without careful review, but the figure has no source and cannot be confirmed. Claudefolio recommends using the default settings for a week, noting what asks unnecessarily, and then writing rules.