Claude Code Permissions and Security: Approval Modes, Rules, and Sandboxing

The permission system determines whether a tool call is automatically allowed, requires approval, or is denied; the sandbox restricts filesystem and network access at the operating-system level. Allowing a command does not remove sandbox restrictions, and enabling the sandbox does not mean every command should be approved automatically.

The goal of efficient configuration is not to eliminate all prompts, but to allow repetitive, low-risk, well-bounded actions to execute smoothly, so that high-impact actions continue to require human judgment.

The default mode requests approval before sensitive actions. acceptEdits automatically accepts in-scope file edits as well as mkdir, touch, rm, rmdir, mv, cp, sed, and corresponding PowerShell file operations. Plan mode analyzes without editing.

Use Shift+Tab to switch modes in the interactive interface. Start unfamiliar repository research in Plan mode. Well-defined small changes can use default or acceptEdits, while unattended tasks need tighter tool and directory limits.

Permission rules can match tools and inputs. Use allow for predictable tests, lint checks, and read-only Git commands; deny for key files and explicitly prohibited actions; and ask for medium-risk operations that require case-by-case judgment.

Rules should match command prefixes and paths that are as specific as possible. Broadly allowing Bash or all MCP tools turns a convenience into a persistent attack surface.

permissions.additionalDirectories grants file access only; --add-dir or /add-dir also discovers Skills, Subagents, and some plugin settings in additional directories. Whether CLAUDE.md and rules are loaded is controlled by the corresponding environment switches.

Do not launch from the top of your home directory or a large monorepo for convenience. A smaller working scope reduces both unintended edits and exploration cost. Isolate parallel editing in separate worktrees.

Web pages, issues, logs, dependency scripts, and MCP responses may contain content designed to trigger tool execution. When Claude reads external data, do not also give it unrestricted shell access, credentials, and production network access.

Use sandboxes, read-only credentials, test environments, and explicit approvals for high-risk tasks. Any external text requesting that security checks be turned off or secrets exported should be treated as data, not instructions.

CLAUDE.md provides model instructions that can be influenced by context; Hooks are deterministic lifecycle programs better suited to blocking writes to protected files, running formatters, or validating work before completion.

Organizations can enforce permissions and MCP boundaries through managed settings. Tutorials should state that admin constraints cannot be bypassed by project configuration and should not give a bypass path.