[Feature Request] Decouple read-only and read-write trust for out-of-workspace directory access

Bug Description
Here's Claude's take on the issue. I can keep hitting the yes prompt but it would be nice to not have to...

Decouple read-trust from write-trust for out-of-workspace access

Working in project A, I frequently need Claude to read files in project B (a sibling dir under my home). There's no safe way to grant this.

What happens: When Claude reads a file outside the working directory, it prompts. Approving it silently writes a Read(//path/**) allow rule to my project
settings — but this rule never helps: the workspace boundary is checked before permission rules, so the next read prompts again. The written rule is dead
on arrival, which looks like a bug and is very confusing.

The real limitation: The only way to stop the prompt is to add the folder to additionalDirectories. But that expands the boundary for reads and writes as
a unit — there's no read-only form. Under acceptEdits (which I use constantly), adding a folder for reads also auto-approves edits, rm, mv, etc. in that
folder. So "let this project read my other projects" unavoidably means "let it silently modify/delete them." That's untenable, so I'm stuck approving
every cross-project read forever.

Requests:

1. A read-only directory grant (e.g. read-only additionalDirectories), so a folder can be readable without becoming auto-writable under acceptEdits.
2. On approving an out-of-workspace read, offer "trust this directory (read-only)" instead of writing a Read(...) rule that can't work.

Read-trust and write-trust are fundamentally different risk levels; the current model conflates them.

---
Two notes:

• Submit it with /feedback in a Claude Code session (that routes to Anthropic).
• If you want, I'll also capture the verified two-gate model + this limitation as a reference memory, so if it comes up again we start from the answer

instead of re-deriving it. Say the word and I'll save it.

Environment Info

• Platform: linux
• Terminal: gnome-terminal
• Version: 2.1.224
• Feedback ID: 269715d5-609c-4313-89d0-0d7bcba27d73

Errors

[]