[BUG] global/local settings.json allow permissions are not respected by Claude Code

Found 3 possible duplicate issues:

1. https://github.com/anthropics/claude-code/issues/11775
2. https://github.com/anthropics/claude-code/issues/1271
3. https://github.com/anthropics/claude-code/issues/12919

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

Would love a fix for this :)

Looking forward for a fix on this.

At least make sure Claude Code himself is aware of this bug.

Any news on this? This bug is very annoying...

For anyone still having issues with this, Anthropic shipped _some_ improvements in 2.1.0, but it still doesn't work well enough.

I encourage you to try claude-code-plus, I solved this in a more sophisticated way than their conservative approach while still being safe, and soon will ship an update that allows you to do regular expressions for permissions.

The way it works is that it parses the commands, regardless of how complex they are and breaks them down into their individual parts and compares each individual part to the permissions. Read some of the tests to get an idea on how we handle complex scenarios.

This also is not respected:

"allow": [
"Write(./**)",
],
"ask": [
"Write"
],

will always ask for permission even when creating new files in project dirs

To me, the problem is solved with the new 2.1.19 Claude Code release.

still happening for me, I think it depends on pipe order -- find | grep, grep | head etc

really annoying, especially for /code-review:code-review plugin

Only fix really is to exit, run with --resume --dangerously-skip-permissions temporarily

Still broken.

Still an issue ; (

Same with explore agent, This problem is making me crazy, because I have to authorize every order (and I can't authorize them all...) 30 times in a row each time Explore is called.

@nbapps @TianyuDu try https://github.com/damusix/ai-tools, in particular: auto-approve-compound-bash

It should reduce it quite a bit. There are 2 permission guards: The one you allow / deny, and the one that you cannot override (CC detects cd && git combinations that are not overridable, for example)

Hooks in ~/.claude/settings.json work globally regardless of project-level settings — they're a reliable alternative when permissions don't apply at the project level.

// ~/.claude/settings.json (user-level, always applies)
{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Bash",
      "hooks": [{"type":"command","command":"~/.claude/hooks/destructive-guard.sh"}]
    }]
  }
}

Unlike permission rules, hooks fire at every level (user and project) and aren't overridden by project settings. If your allow/deny rules are being ignored at the project level, moving the logic into hooks is the most reliable workaround.
Quick setup: npx cc-safe-setup installs 8 hooks in user-level settings.

still facing this issue

@bcherny Can you please prioritize this? It's open since 2025 and makes Claude Code a complete pain to use. I have to constantly manually approve basic commands such as find or cmake.

still an issue. Super weird because this:

  "permissions": {
    "allow": [
      "Bash(*)"
    ]
  },

works as expected (no prompt for any bash command, eg. touch ~/file.txt)
but this

  "permissions": {
    "allow": [
      "Bash(touch *)"
    ]
  },

still requires my approval when running touch ~/file.txt for instance.

@ChristianTrummer99 try Bash(touch:*), you have a missing colon in the second example.

@ChristianTrummer99 try Bash(touch:*), you have a missing colon in the second example.

I've tried this too. Doesn't make a difference.

here's my actual settings file:

{
  "permissions": {
    "allow": [
      "Edit",
      "Write",
      "MultiEdit",
      "Bash(touch:*)"
    ]
  },
  "sandbox": {
    "enabled": true,
    "autoAllowBashIfSandboxed": true,
    "allowUnsandboxedCommands": true
  }
}

I suspect the harness's handling of sandboxing is what causes this issue.

Try out claude-code-plus npx claude-code-plus, I've been using it for ~4 months and it solved all my issues. Admittedly, I don't use any of the sandboxing features, but I don't think it should be relevant to this issue.