Use both. Approve a small allowlist of safe, repeatable commands, ask for everything else, and add deny rules for the clearly dangerous ones. Then back it with a sandbox, because command rules match the text an agent writes, not every program path or wrapper that could do the same thing.
How the rules are evaluated
Claude Code documents three rule types: deny, ask and allow. They are evaluated in that order and the first match wins, so an allow rule cannot override a broader deny. In Manual mode, shell commands need approval except a built-in set of read-only commands such as ls, cat and grep. You can attach an ask rule to force a prompt even for one of those.
Decision table
| Approach | Good for | Weak spot |
|---|---|---|
| Allowlist only | Predictable commands such as test and lint | Every new command prompts, so people click yes without reading |
| Denylist only | Blocking known dangerous commands | Anything unlisted runs |
| Allow plus ask plus deny | Most teams | Needs upkeep |
| Any of these plus sandbox | Untrusted repositories, unattended runs | Setup and compatibility work |
A safe starting set
{
"permissions": {
"allow": ["Bash(npm test *)", "Bash(npm run lint)"],
"ask": ["Bash(git push *)"],
"deny": ["Bash(rm -rf *)", "Bash(curl *)", "Bash(wget *)"]
}
}
Network tools are a common deny. The documentation suggests denying curl and wget and using a domain-scoped fetch permission for approved sites, then pairing that with the sandbox network allowlist, because a deny rule does not match the same program invoked by full path or inside sh -c.
What rules do not do
The documentation is direct that a Bash rule matches the command text after splitting compound commands and stripping wrappers, and is not a security boundary around the program. That means three habits matter:
- Keep the allow list narrow, with arguments pinned where possible.
- Do not approve broad patterns such as a bare interpreter.
- Use the sandbox for anything unattended.
Prompt fatigue is a risk
If an agent asks forty times an hour, people stop reading. A good allowlist reduces prompts for routine work so the remaining prompts get real attention.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the gate to see a second check that still applies after an agent has finished its work.
Quick check
Can an allow rule override a deny rule?
No. In Claude Code, deny is checked first, and the first match decides.
Is a denylist for rm enough?
No. The same effect can come from other forms of the command, so combine rules with a sandbox and a clean working tree.
Safeguard policies and gates add a merge-time check regardless of what ran locally, and a free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
