05 / 20Permissionssrc/utils/permissions/

3-layer permission model.

Tool Registry Filter removes denied tools before Claude sees them. Per-call check validates args + working directory. If no rule matches, user prompted. Bash AST analysis detects rm -rf, fork bombs, curl|bash, sudo escalation.

Layers — filter, check, prompt

24+

Bash validators — AST-level

Rule sources in priority chain

3-Layer Model

1Tool Registry Filter — filterToolsByDenyRules() removes denied tools before Claude sees them. Claude cannot call what it cannot see.

2Per-call Permission Check — canUseTool() validates tool name, arguments, working directory against allow/deny/ask rules.

3Interactive User Prompt — If no rule matches: "allow once", "allow always", or "deny". Response becomes a session-level rule.

Operating Modes

Mode	Behavior
default	Prompt for risky tools only
acceptEdits	Auto-allow file edits; prompt for shell
plan	Read-only — requires approval before execution
auto	ML classifier decides ANT internal-only
bypassPermissions	Skip all checks (dangerous — killswitch available)
dontAsk	Never prompt, auto-deny unsafe operations
bubble	Fork subagent — prompts surface to parent UI

Rule Priority (8 Sources)

policySettings

Organization policy (managed-settings.json) — highest priority, cannot be overridden

userSettings

~/.claude/settings.json

projectSettings

.claude/settings.json (repo-level)

localSettings

.claude/settings.local.json (not committed)

flagSettings

--settings CLI flag

cliArg

Command-line arguments

command

User response to permission prompt

session

Runtime modifications — lowest priority

Bash Safety — AST Analysis

rm -rf /, fork bombs, curl | bash, sudo escalation, TTY injection, history manipulation — all rejected before canUseTool() via tree-sitter AST parsing with regex fallback. Max 50 subcommands per compound command (prevents CPU exhaustion).

See slide 10 — Security for the full 24+ validator breakdown.