What Claude is allowed to do
When I finally read my Claude Code permissions file, it held about 120 entries. Some pointed at folders I'd moved weeks earlier. I hadn't decided any of them. Each one was a click on "yes, and don't ask again."
Settings are the part of a setup most people never open. Claude Code reads them from three files, and each has a different job. My user settings, in my home folder, follow me into every repo and hold the model, the hooks and how long transcripts are kept. The project settings live in the repo and are the ones I'd share with a team. The local settings sit beside them, ignored by git, for me alone. The project file overrides the user file, and the local file overrides both.
My project file is short and deliberate. It allows a short list of everyday commands, such as running SQL, reading work items, fetching from git, and only the read-only tools of the one MCP server I enable, for Azure DevOps.
The local file was the one with 120 entries, and every click had written a line into it. Some were one-off commands frozen with a ticket number in them. Some repeated entries already in the project file. And a handful of broad wildcards, such as any git command or any Python script, made most of the rest pointless.
My user file had the same problem on a smaller scale, with seven Azure CLI commands, each approved on its own, one of them listed twice, and then a single wildcard that covered all of them.
None of it was dangerous on its own. The problem was that my permissions had piled up one click at a time.
Here is what I do now.
Everyday commands go in the project file, on purpose. It's the one I'd share with a team.
Broad permissions are fine when a hook guards the dangerous edge. I let Claude run any git command, and a hook refuses a commit to a protected branch. The permission keeps it fast. The hook keeps it safe.
Autonomy is a setting too. I run in auto mode, where routine actions are approved without asking, and I have listed the actions it must never wave through, such as deleting cloud resource groups.
Anything I don't use gets turned off. I disable the claude.ai connectors inside Claude Code, so a coding session isn't carrying email and calendar tools it will never call.
And the local file gets read now and then, and pruned. Typing /permissions in a session lists every rule and which file it came from.
Settings are the dull part of the setup, which is exactly why they drift. They decide what Claude can do before it reads a single instruction.
When did you last open your own settings files? What was in there that you didn't remember allowing?
Setting Up Claude, part 2 of 10. Next: Rules that load by path.