Anurag Singh writes about combining Claude Code's Auto mode with deny rules and ask rules to eliminate the need to manually approve every command. The setup lets Claude Code work uninterrupted in the background while hard-blocking destructive commands like force-pushes and rm -rf, and optionally prompting on risky-but-acceptable actions like git push.
- Deny rules are enforced by Claude Code itself rather than being instructions to the model, so they hold even in bypassPermissions mode
- A deny list can never be exhaustive; Claude could accomplish the same destructive action through a different tool (e.g., Python instead of rm)
- The built-in sandbox is a stronger safety net than any deny list, though it becomes tedious for projects depending on local databases, Docker, or private registries
- Permission rules are evaluated in fixed priority order: deny first, then ask, then allow
- Deny rules are enforced by Claude Code itself rather than being instructions to the model, so they hold even in bypassPermissions mode
- A deny list can never be exhaustive; Claude could accomplish the same destructive action through a different tool (e.g., Python instead of rm)
- The built-in sandbox is a stronger safety net than any deny list, though it becomes tedious for projects depending on local databases, Docker, or private registries
- Permission rules are evaluated in fixed priority order: deny first, then ask, then allow
