Permissions and Access Control

Explore the permissions system in Claude Code to understand how access control is enforced through allow and deny patterns. Learn the pattern syntax, precedence rules, and how to design a minimal permission set that follows least privilege. Understand how unmatched calls prompt user approval and how to scope permissions in projects to maintain secure, production-ready AI workflows.

We'll cover the following...

Pattern syntax
Precedence: Deny overrides allow
Unmatched tool calls: The prompt fallback
Designing a minimal permission set
Scoping permissions by directory
Exercise: Apply the rules
What's next?

The permissions system is how Claude Code enforces access control at the harness level, independent of what Claude decides. When a tool call matches a deny pattern, Claude Code cancels it regardless of Claude’s reasoning. When it matches an allow pattern, it proceeds without prompting the user. For everything else, Claude Code pauses and asks. This lesson covers the pattern syntax, precedence rules, and the practical design of a minimal permission set for a production project. By the end of this lesson, we will be able to:

Write allow and deny patterns using the correct syntax for built-in tools.
Explain the precedence rule when an allow and a deny pattern both match the same tool call.
Identify what happens when a tool call matches neither allow nor deny.
Design a permission set that follows the principle of least privilege.

Pattern syntax

Permission patterns use the form ToolName(argument-pattern). The tool name matches one of Claude Code’s built-in tools. The argument pattern is a glob applied to the relevant argument of that tool call. The built-in tools and their matchable arguments are:

Tool	Matched Argument	Example Pattern
`Bash`	The shell command string	`Bash(git *)`
`Read`	The file path	`Read(src/**)`
`Write`	The file path	`Write(src/**)`
`Edit`	The file path	`Edit(src/**)`
`Glob`	The glob pattern argument	`Glob(**)`
`Grep`	The search pattern	`Grep(**)`
`WebFetch`	The URL	`WebFetch(https://docs.anthropic.com/*)`
`WebSearch`	The search query	`WebSearch(*)`

1.Claude AI Systems Foundations

2.Building Agents with the Claude Client SDK

3.Architecting Agentic Systems

4.Orchestrating Multi-Agent Systems

5.Designing Tools and MCP Integrations

6.Prompting and Schema Design

7.Claude Code Configuration and Project Workflows

8.Validation, Retry Loops, and Metrics

9.Context Management Techniques

10.Making Reliable Claude Systems

Permissions and Access Control

Pattern syntax