[FEATURE] Claude Code permissions: allow only specific files

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

I want to restrict Claude Code to read only specific files (e.g., README.md, *.yml) and deny everything else.

It looks like deny takes precedence, deny ["./**"] + allow ["./README.md"] blocks everything.

Proposed Solution

{
  "permissions": {
    "restrictToAllowListOnly": true,
    "allow": [
      "Read(./README.md)",
      "Read(./docs/**/*.md)",
      "Read(./**/*.yml)"
    ]
  }
}

Alternative Solutions

I have not found any alternatives yet

Priority

Medium - Would be very helpful

Feature Category

File operations

Use Case Example

On large-scale and sensitive projects, it would be necessary, as a precautionary measure, to have the option to deny everything and only authorize certain files (CICD pipelines, Markdown files, a few scripts, etc.) that allow you to move forward within your scope of work and therefore not on the project as a whole.

Additional Context

_No response_