[DOCS] Documentation Contradiction: Bash Permission Matching Logic (Prefix vs Wildcard)

Documentation Type

Missing documentation (feature not documented)

Documentation Location

• https://code.claude.com/docs/en/settings - https://code.claude.com/docs/en/iam

Section/Topic

• In docs/en/settings, the "Permission settings" table. - In docs/en/iam, the "Tool-specific permission rules" section (specifically the Bash subsection).

Current Documentation

In settings.md (https://code.claude.com/docs/en/settings#permission-settings), the description for allow says:

"Array of permission rules to allow tool use. Note: Bash rules use prefix matching, not regex"

And the description for deny says:

"Note: Bash patterns are prefix matches and can be bypassed..."

However, in iam.md (https://code.claude.com/docs/en/iam#tool-specific-permission-rules), the documentation says:

"**Bash permission rules support both prefix matching with : and wildcard matching with **: ... The * wildcard can appear at any position and matches any sequence of characters"

What's Wrong or Missing?

The documentation in settings.md contradicts iam.md. The settings documentation explicitly states that Bash rules rely on "prefix matching," implying that standard wildcards do not work or only work at the end of the string. The IAM documentation correctly reflects newer functionality where the * wildcard can appear at any position (e.g., Bash(* install)).

This contradiction makes it difficult for users to know if they can use patterns like Bash(*.py) or Bash(npm run *) inside their settings.json file.

Suggested Improvement

Update the "Permission settings" table in https://code.claude.com/docs/en/settings to reflect that Bash rules support full wildcard matching, not just prefix matching.

Suggested change for allow description in settings.md:

"Array of permission rules to allow tool use. Bash rules support wildcard (*) matching at any position."

Suggested change for deny description in settings.md:

"Array of permission rules to deny tool use. Use this to also exclude sensitive files from Claude Code access."

Impact

High - Prevents users from using a feature

Additional Context

Recent updates to Claude Code (around v2.1.0) introduced full wildcard pattern matching for Bash tool permissions. It appears the IAM documentation was updated to reflect this feature, but the specific table in the Settings documentation contains outdated legacy text describing the old prefix-only behavior.