How to Set Up a Permissions Allowlist in Claude Code

By default Claude Code asks permission before running shell commands or editing files. That is safe but noisy. A permissions allowlist lets you pre-approve harmless commands like the test runner while keeping a deny list for anything destructive. This guide configures both.

What you need

• Claude Code installed in a project
• A sense of which commands you run constantly (tests, lint, git status)
• About 10 minutes

Step 1: See what you keep approving

Work for a session and notice which prompts repeat. Read-only commands like the ones below are safe to allow permanently.

Step 2: Add an allow list

In your project settings, add a permissions block. Each rule names a tool and an optional argument pattern. Below allows the common safe commands and all edits within the project.

{
  "permissions": {
    "allow": [
      "Bash(npm test:*)",
      "Bash(npm run lint)",
      "Bash(git status)",
      "Bash(git diff:*)",
      "Edit",
      "Read"
    ]
  }
}

Step 3: Add a deny list for dangerous actions

A deny rule always wins over an allow rule. Block the commands you never want run unattended, even by accident.

{
  "permissions": {
    "allow": [
      "Bash(npm test:*)",
      "Bash(git status)",
      "Edit"
    ],
    "deny": [
      "Bash(rm -rf:*)",
      "Bash(git push:*)",
      "Bash(curl:*)"
    ]
  }
}

Step 4: Confirm the rules work

Start a session and trigger an allowed command and a denied one. The allowed command should run silently; the denied one should be refused.

Result: routine work flows without interruption while the riskiest commands stay blocked, giving you speed without giving up the safety rail.