Dokumentationerreichbar
Anthropic, Configure permissions
code.claude.com (externe Seite)
Die Herstellerdokumentation zu den Rechteregeln. Sie enthält den Satz, der die Grenze zwischen einer Projektanweisung und einem Riegel zieht: Durchgesetzt wird von der Umgebung, und was im Auftrag steht, beeinflusst nur den Versuch. Dazu die Rangfolge der drei Regelarten und eine Falle, die still bleibt: Pfadregeln werden allein gegen Edit und Read geprüft, eine auf Write geschriebene Regel nimmt die Umgebung an und schlägt sie nie nach.
geprüft 10.11.2026
Worauf sich diese Seite beruft, wörtlich, abgerufen am 28.08.2026:
Permission rules are enforced by Claude Code, not by the model.
bestätigt 10.11.2026Rules are evaluated in order: deny, then ask, then allow.
bestätigt 10.11.2026An allow rule can’t carve an exception out of a deny rule.
bestätigt 10.11.2026They don't apply to a command that reads files without naming them, such as grep -r pattern . run from the directory that holds the file, or to arbitrary subprocesses that read or write files indirectly, like a Python or Node script that opens files itself.
bestätigt 10.11.2026Claude Code runs npm scripts and git commits without asking and refuses commands that begin with git push
bestätigt 10.11.2026A push written another way, such as git -C . push
bestätigt 10.11.2026Content-scoped ask rules like Bash(git push *) still force a prompt
bestätigt 10.11.2026Your other rules and the permission mode decide the commands in the last column.
bestätigt 10.11.2026a deny or ask rule covers the invocation Claude usually produces and isn't a security boundary around the program
bestätigt 10.11.2026For filesystem and network enforcement that doesn't depend on the command text, use sandboxing.
bestätigt 10.11.2026The hook output can deny the tool call, force a prompt, or skip the prompt to let the call proceed.
bestätigt 10.11.2026Claude Code evaluates deny and ask rules regardless of what a Pre
bestätigt 10.11.2026Tool Use hook returns The first match in that order determines the outcome, and rule specificity doesn’t change the order.
bestätigt 10.11.2026A file-modification approval isn’t saved to the file
bestätigt 10.11.2026Claude Code offers those options only when the prompt can show you everything they would allow
bestätigt 10.11.2026You can attach a note to Claude when you approve or deny a single action.
bestätigt 10.11.2026If you select No without a comment on a prompt from the main conversation, Claude Code stops the turn.
bestätigt 10.11.2026A bare tool name like Bash removes the tool from Claude’s context entirely, so Claude never sees it.
bestätigt 10.11.2026The dialog lists all permission rules and the settings.json file each rule comes from.
bestätigt 10.11.2026when you add or remove a rule, Claude Code applies the change starting with Claude’s next tool call in the same turn
bestätigt 10.11.2026A * in a Bash rule matches any text, including spaces, so one rule covers a family of commands.
bestätigt 10.11.2026Claude Code matches everything before the first * as written, so those words are what limit the rule
bestätigt 10.11.2026Claude Code warns at startup about an allow rule with a * before the subcommand
bestätigt 10.11.2026The space before a trailing * is part of the rule.
bestätigt 10.11.2026Every subcommand must be allowed for a compound command to run without a prompt
bestätigt 10.11.2026Deny and ask rules apply when any subcommand matches them
bestätigt 10.11.2026Up to 5 rules may be saved for a single compound command.
bestätigt 10.11.2026Before matching Bash rules, Claude Code strips a fixed set of wrappers
bestätigt 10.11.2026This wrapper list is built in and is not configurable.
bestätigt 10.11.2026Because these tools execute their arguments as a command
bestätigt 10.11.2026Deny and ask rules can match a top-level input parameter on any built-in tool with Tool(param:value)
bestätigt 10.11.2026An allow rule for one parameter value wouldn’t establish that the call is safe overall
bestätigt 10.11.2026A parameter the model omits is never matched
bestätigt 10.11.2026You can’t match a tool’s primary content field this way
bestätigt 10.11.2026To match a parameter on an MCP tool, pass a deny rule with --disallowed
bestätigt 10.11.2026Tools it skips any mcp__ rule that has parentheses
bestätigt 10.11.2026Deny and ask rules also accept glob patterns in the tool-name position.
bestätigt 10.11.2026Allow rules accept tool-name globs only after a literal mcp__<server>__ prefix.
bestätigt 10.11.2026allow rules for that tool don’t take effect
bestätigt 10.11.2026A deny or ask rule whose tool name matches no known tool produces a startup warning to catch typos.
bestätigt 10.11.2026If a tool is denied at any level, no other level can allow it.
bestätigt 10.11.2026a managed settings deny can’t be overridden by --allowed
bestätigt 10.11.2026Tools Permanently per repository and command
bestätigt 10.11.2026A hook that exits with code 2 stops the tool call before permission rules are evaluated
bestätigt 10.11.2026register a Pre
bestätigt 10.11.2026Tool Use hook that rejects those specific commands A mod you install that handles the tool.check event gives its answer after the Pre
bestätigt 10.11.2026Tool Use hooks have run. a call the mod approves runs without a classifier check
bestätigt 10.11.2026With neither managed settings nor a Team or Enterprise /
steht dort nicht mehrlogin as the session’s credential, the mod can approve a call that a deny rule refuses or a Pre Tool Use hook blocked. You can check permission settings into version control to share them with every developer in your organization
bestätigt 10.11.2026Edit rules apply to all built-in tools that edit files.
bestätigt 10.11.2026For OS-level enforcement that blocks all processes from accessing a path, enable the sandbox
bestätigt 10.11.2026The single leading slash anchors at the settings source, not the filesystem root.
bestätigt 10.11.2026Read and Edit deny rules apply to Claude’s built-in file tools, to file commands Claude Code recognizes in Bash, such as cat
bestätigt 10.11.2026and to the targets of Bash redirections such as
bestätigt 10.11.2026Paths and domains from both sandbox settings and permission rules are merged into the final sandbox configuration
bestätigt 10.11.2026Claude Code recognizes a built-in set of Bash commands as read-only and runs them without a permission prompt in every mode
bestätigt 10.11.2026A * at the end, with a space before it, also matches the bare command.
bestätigt 10.11.2026The * stands in for whatever text is in its place.
bestätigt 10.11.2026When a command redirects output or input, Claude Code checks the redirect target against your file rules as if Claude wrote or read that file directly
bestätigt 10.11.2026Claude Code checks tee targets in v2.1.269 and later.
bestätigt 10.11.2026A /
bestätigt 10.11.2026path pattern anchors at a directory associated with the settings source that defines it, so the same rule matches different locations depending on where you put it edits in <primary working directory>/
bestätigt 10.11.2026docs/ CLI flags or session rules <primary working directory>/
bestätigt 10.11.2026path apply only when both the requested path and the file it resolves to match
bestätigt 10.11.2026apply when either the requested path or the file it resolves to matches
bestätigt 10.11.2026you’re prompted for it instead of the classifier deciding
bestätigt 10.11.2026the Edit and Write tools refuse the write and direct Claude to the link’s target
bestätigt 10.11.2026A prefix rule like Bash(watch *) or Bash(find *) can't auto-approve the following commands, so in Manual mode they prompt
bestätigt 10.11.2026To approve a specific invocation that has no * in it, write an exact-match rule for the full command string
bestätigt 10.11.2026Claude Code reads the rule as a wildcard pattern, not an exact match, so the command still prompts
bestätigt 10.11.2026Approve it each time it prompts, or use a Pre
bestätigt 10.11.2026Tool Use hook A network path is one that can reach another computer
bestätigt 10.11.2026Looking up such a path can contact the host it names, and on Windows that contact can send the host your credentials.
bestätigt 10.11.2026In Claude Code v2.1.292 and later, each of these leaves the prompt in place
bestätigt 10.11.2026a rule doesn't pre-approve the read, including a rule for the whole tool, such as Read
bestätigt 10.11.2026the prompt comes to you, and the classifier doesn't decide the read
bestätigt 10.11.2026In dont
bestätigt 10.11.2026Ask mode, Claude Code denies the read instead of prompting. In bypass
bestätigt 10.11.2026Permissions mode, and in interactive terminal sessions in plan mode with bypass permissions available, the read runs without this prompt. To read files on a network share without this prompt, give the share a local path first
bestätigt 10.11.2026In plan mode, a mod that handles tool.check also can’t approve a file edit or another call that isn’t read-only, though it can still block such a call.
bestätigt 10.11.2026With managed settings on the machine, or a Team or Enterprise /
steht dort nicht mehrlogin as the session’s credential, these outcomes stay in place by default when the mod approves a call A session that runs on an API key or a long-lived CLAUDE_CODE_OAUTH_TOKEN instead isn’t using that login, even when that login is stored.
bestätigt 10.11.2026dont
bestätigt 10.11.2026Ask mode: the mod can approve a call that nothing but the mode would deny. There the classifier checks the call first.
bestätigt 10.11.2026It accepts a rule with a path other than * for one of the tools below but doesn’t match a read, search, or edit against it.
bestätigt 10.11.2026with an action that runs commands, deletes files, or writes files, such as -exec, -delete, -rm, or -fprint, or with -files0-from
bestätigt 10.11.2026That includes -c, which makes git run a program you name.
bestätigt 10.11.2026Use both for defense-in-depth, since sandbox restrictions still apply even if a prompt injection bypasses Claude’s decision-making.
bestätigt 10.11.2026To make Claude’s file tools refuse paths outside the working directories in every permission mode, including bypass
bestätigt 10.11.2026Permissions the file tools refuse reads there, apart from files Claude Code itself needs
bestätigt 10.11.2026file commands Claude Code recognizes in Bash, such as cat, head, tail, sed, and tee
bestätigt 10.11.2026has no effect on a file edit or another call that isn’t read-only
bestätigt 10.11.2026In one settings file’s deny list, Read(*.env) followed by Read(!sample.env) blocks every file whose name ends in .env at any depth, except files named sample.env.
bestätigt 10.11.2026The carve-out reaches only rules from the same source.
bestätigt 10.11.2026A call that a deny rule refuses stays refused, and your organization can change that.
steht dort nicht mehr
Erst der rote Test02 Die Werkzeuge04 Die Werkzeuge des Agenten08 Berechtigungen und Rechtemodi11 Eine Wissensbasis aufbauen12 Rechner und Netz pflegen16 Rechte und Sandbox18 Hooks und Mods26 Git und Forges31 Der Harness