Chapter 6 · Permission Model and Security Settings

Chapter goals: Understand Claude Code's permission model, master allowedTools/deny configuration, project trust mechanisms, and secret protection, following the principle of least privilege to safely use the AI coding assistant.

6.1 Permission Model Overview

Claude Code uses a tiered permission model: by default, reading files and searching code requires no confirmation, but "side-effect" operations like writing files, executing Bash commands, and installing dependencies require per-approval from the user.

┌──────────────────────────────────────────────┐
│              Permission Tiers                  │
├──────────────────────────────────────────────┤
│ Read-only (auto-allowed)                      │
│   Read / Grep / Glob / LS                    │
├──────────────────────────────────────────────┤
│ Write (requires approval or pre-config)       │
│   Write / Edit / NotebookEdit                │
├──────────────────────────────────────────────┤
│ Execute (requires approval or pre-config)     │
│   Bash / WebFetch / mcp__*                   │
├──────────────────────────────────────────────┤
│ Dangerous (always requires human confirmation)│
│   rm -rf / curl | sh / secret access         │
└──────────────────────────────────────────────┘

Design Philosophy

Anthropic's security philosophy is "secure by default, explicit to放开" — you tell Claude what it can do, rather than listing what it cannot. This is less prone to遗漏 than a blacklist approach.

6.2 allowedTools: Pre-Approved Tools

Configure in .claude/settings.json (project-level) or ~/.claude/settings.json (global-level):

{
  "permissions": {
    "allow": [
      "Bash(npm run test:*)",
      "Bash(git commit:*)",
      "Bash(git push origin feature/*)",
      "Edit",
      "Write"
    ],
    "deny": [
      "Bash(rm -rf:*)",
      "Bash(curl * | sh)",
      "Read(.env*)",
      "Read(**/*.pem)"
    ]
  }
}

Common rule syntax:

Rule	Meaning
Bash(git commit:*)	Allow all commands starting with git commit
Edit	Allow all file edits
WebFetch(domain:api.github.com)	Only allow requests to that domain
mcp__github__create_issue	Allow calling a specific MCP tool
Read(.env*)	Prohibit reading environment variable files

6.3 --dangerously-skip-permissions

# Skip all permission checks — extremely dangerous!
claude --dangerously-skip-permissions

This flag skips all tool call confirmations. Use cases are extremely limited:

• ✅ Running isolated tasks inside a Docker container;
• ✅ Automation in CI/CD pipelines in constrained environments;
• ❌ Daily development on the host machine — never do this.

# Dockerfile — safe unattended example
FROM node:20-slim
RUN curl -fsSL https://claude.ai/install.sh | bash
WORKDIR /workspace
COPY . .
CMD ["claude", "-p", "Run all tests and fix failures", \
     "--dangerously-skip-permissions"]

Even if Claude makes destructive操作 inside the container, only the container layer is affected — the host is safe.

6.4 Project Trust Mechanism

The first time you enter a new directory, Claude Code prompts for trust:

⚠️ Do you trust the files in this folder?
   /home/user/new-project

   Files from untrusted sources may contain malicious
   instructions that could affect Claude's behavior.

After selecting "Yes, proceed":

• The directory is marked as trusted;
• Project-level rules in .claude/settings.json take effect;
• Custom instructions in CLAUDE.md are loaded.

Security Risks of Cloning Repositories

When cloning someone else's project from GitHub, a malicious repo may inject dangerous rules into .claude/settings.json or embed prompt injection instructions in CLAUDE.md. Always review before trusting:

git clone https://github.com/xxx/repo.git
cd repo

# Check for suspicious configs first
cat .claude/settings.json 2>/dev/null
cat CLAUDE.md 2>/dev/null | head -30

# After confirming no issues, start
claude

6.5 Least Privilege Practice

Scenario 1: Let Claude write code but not run commands

{
  "permissions": {
    "deny": ["Bash"]
  }
}

Scenario 2: Read-only analysis — block all modifications

claude --allowedTools "Read,Grep,Glob,LS" \
       -p "Analyze this project's architecture and output a report"

Scenario 3: Limit editable scope

{
  "permissions": {
    "allow": [
      "Edit(src/**)",
      "Write(src/**)",
      "Bash(npm test:*)"
    ],
    "deny": [
      "Edit(infrastructure/**)",
      "Write(.env*)"
    ]
  }
}

6.6 Secret and Environment Variable Protection

Claude Code may encounter sensitive information through Read or Bash. Defense strategies:

{
  "permissions": {
    "deny": [
      "Read(.env)",
      "Read(.env.local)",
      "Read(**/secrets/**)",
      "Read(**/*credential*)",
      "Bash(echo $AWS_SECRET_ACCESS_KEY)",
      "Bash(cat *key*)"
    ]
  }
}

Additional recommendations:

1. Use .claudeignore (similar to .gitignore) to exclude sensitive directories from indexing;
2. Secret management tools: use direnv or Vault to inject env vars instead of plaintext storage;
3. Regular audits: check ~/.claude/projects/ for accidentally recorded sensitive conversation content.

Chapter Summary

• Three-tier permissions: read-only auto-allowed → writes require approval → danger always confirmed;
• The allow/deny arrays in settings.json实现 fine-grained control;
• --dangerously-skip-permissions is limited to container or other isolated environments;
• New directories must pass the trust prompt before loading project-level config;
• Always follow least privilege; use deny lists to protect secret files.

🧪 随堂测验

点击你认为正确的选项。答错时会展示正确答案与原因解析。

1. Which operations does Claude Code auto-allow by default without user confirmation?

2. What is the appropriate use case for the --dangerously-skip-permissions flag?

3. Why should you not immediately trust a project after cloning a third-party repo?

4. Which deny rule effectively protects AWS secrets?

🛠️ Hands-on Practice

1. Create .claude/settings.json for your project: allow npm test and git commit, but deny reading .env files.
2. Start in read-only mode with claude --allowedTools "Read,Grep,Glob" and have it analyze the project architecture.
3. Review a public repo's .claude/settings.json and CLAUDE.md; assess whether there are security risks.

After completing the exercises, proceed to Chapter 7: Multi-turn Sessions and Context Management.