← Blog · 2026-10-17

Claude Code Keeps Asking for Permission? How to Stop the Prompts Safely

Shortcut: our free permissions builder writes the permissions block for settings.json, flags rules that won't do what you expect, and shows which rule decides a command you type. It runs in your browser.

Claude Code asks before it runs most shell commands, edits a file or fetches a web page. That is the Manual mode (default) working as designed. The prompts become a problem when you approve the same npm run test for the tenth time, or when "Yes, and don't ask again" doesn't seem to stick.

You have three levers: permission rules (allow, ask, deny), the permission mode a session starts in, and where the rules are saved. Here is how to use them without handing Claude a blank check.

1. Know what asks and what doesn't

From Anthropic's permissions docs:

• File reads and searches inside your working folders don't ask.
• A built-in set of read-only shell commands doesn't ask: ls, cat, echo, pwd, head, tail, grep, find, wc, which, diff, stat, du, cd and read-only git commands. You can't add to this list, but you can force a prompt with an ask rule.
• Other shell commands ask. "Don't ask again" saves a rule for that repository.
• File edits ask. "Don't ask again" for an edit lasts only until the session ends; it is never written to a file. That is the most common reason approvals seem to "forget".
• Web fetches ask, except a built-in list of documentation domains. Web search asks.

2. Why "don't ask again" didn't stick

• It was a file edit. Edit approvals are per session (see above). Use acceptEdits mode or an Edit(...) allow rule instead.
• The command was compound. For git status && npm test, Claude Code saves a separate rule for each part that needs approval, not one rule for the whole line. A different combination later can still contain an unapproved part.
• The command started with an exec wrapper or used find -exec / -delete. A prefix rule can't auto-approve watch ... or find ... -delete, so these keep prompting. Write an exact rule for the full command, or approve each time.
• You only got a one-time "Yes". Claude Code offers "don't ask again" only when the prompt can show everything the saved rule would allow. When it can't, add the rule yourself with /permissions.
• You're in a different repository, or an older Claude Code version saved the rule in a subdirectory. Rules saved from prompts go to .claude/settings.local.json at the repository root (since v2.1.211).

3. Write allow rules for the commands you trust

Add rules to settings.json under permissions.allow. Write the command, and replace the parts that change with *:

{
  "permissions": {
    "allow": [
      "Bash(npm run *)",
      "Bash(git add *)",
      "Bash(git commit *)"
    ],
    "ask": [
      "Bash(git push *)"
    ],
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)"
    ]
  }
}

Four rules of thumb from the docs:

1. Put the * after the subcommand. Bash(git commit *) allows commits. Bash(git *) allows every git command, including git push and git -c ..., which can run a program you name.
2. Mind the space. Bash(ls *) matches ls and ls -la but not lsof. Bash(ls*) matches all three.
3. Deny beats ask beats allow. Claude Code checks deny rules first, then ask, then allow, and the first match wins. A narrow allow can't carve an exception out of a broad deny.
4. Allow has to match every part of a compound command; deny and ask only have to match one part.

Not sure what a rule will catch? Paste it into the permissions builder and type a command into its tester.

4. Pick a mode instead of approving edits one by one

Set defaultMode in permissions, or switch during a session:

• acceptEdits auto-accepts file edits and common file commands such as mkdir, touch, mv and cp inside your working folders. Shell commands still follow your rules. This is the mode most people want when edit prompts are the problem.
• plan reads and plans without editing your source files.
• auto replaces routine prompts with a background classifier that checks actions against your request, where your plan offers it.
• dontAsk refuses anything that would have prompted, so only reads and your allow rules run. Useful for scripts.
• bypassPermissions skips prompts. Anthropic's docs say to use it only in isolated environments like containers or VMs. You can lock yourself out of it with "disableBypassPermissionsMode": "disable".

5. Save rules in the right file

• .claude/settings.json: this project, checked in and shared with your team. Allow rules here apply only after you accept the folder's trust dialog.
• .claude/settings.local.json: this project, just you. Prompt approvals land here.
• ~/.claude/settings.json: every project. Path rules with one leading slash, like Read(/secrets/**), are relative to ~/.claude here, so use ~/ or // paths for rules meant to work everywhere.

If a rule exists at any level as a deny, no other level can allow it.

6. Things rules can't do

• A deny rule on Bash(curl *) stops curl https://... but not /usr/bin/curl or sh -c 'curl ...'. Rules match the text Claude writes, not the program. For a hard boundary, use sandboxing or a PreToolUse hook (our hooks generator builds a guard hook).
• Path rules on Write are accepted but never checked. Use Edit(...) for anything that changes files and Read(...) for reads; a Read deny also blocks Edit and Write on that path.
• Instructions in CLAUDE.md shape what Claude tries, but they don't change what Claude Code allows.

Rules spread across user, project and local files? The free settings precedence checker merges them and flags allow rules that an ask or deny rule cancels. For settings that seem ignored altogether, see Claude Code settings not applying? 12 causes and fixes.

Facts on this page come from Anthropic's permissions documentation. This guide isn't affiliated with Anthropic.

If you use Claude Code for client work, skills handle the repeat jobs so you spend less time steering. Start with our free 3-skill sample (client follow-ups, meeting notes to tasks, invoice chasing), or get the full Solo Consultant Kit.