Building productivity superpowers with Claude Code

Settings & security

How to control and secure Claude Code

A handful of plain-text files control Claude Code — your personal defaults, with each project layering its own on top. No need to memorize this: Claude can read, explain, and change its own configuration when you ask.

On conflict: managed policy → command line → local → project → user. Permission rules instead merge across files — and a deny anywhere always wins.

Permissions: every action is checked first

Every action is checked against your rules: deny (blocked, always) → ask (pauses for your OK) → allow (runs without asking). No rule matched? Safe reads just run; anything risky prompts you. These are guardrails enforced by the app itself — not suggestions.

Paths are gitignore-style: ~/… = home, /src/… = project root, //… = absolute. :* makes a Bash rule match a prefix.

Permission modes — the big lever

Cycle modes with Shift+Tab in the terminal (mode picker in the desktop app); set where sessions start with defaultMode.

A real settings.json, annotated

{
  "permissions": {
    "defaultMode": "acceptEdits",
    "allow": [ "Bash(npm run test:*)" ],
    "ask":   [ "Bash(git push:*)" ],
    "deny":  [ "Read(./.env)", "Read(./secrets/**)" ]
  }
}

Three ways to change settings