The idea
A coding agent may inspect a repository, change files, run shell commands, or use connected services. That is useful, but it creates a simple question: who decides whether an action may happen?
Permissions are controls that answer that question. They decide which actions can run automatically, which need your approval, and which are blocked. The exact names vary by tool. In Claude Code, the permission system covers actions such as reading files, modifying files, running Bash commands, and using web-related tools. Read-only file operations in allowed working directories generally need no approval; file modifications and Bash commands generally require it in manual mode. Anthropic documentation
A prompt is different. It is text that tells an AI what you want, such as “inspect the failing test and propose a minimal fix.” A prompt can influence what the model tries to do. It does not grant access. Claude Code says that its client, the application running the agent session, enforces permission rules; prompts and CLAUDE.md instructions do not override them. Anthropic documentation Anthropic memory documentation
Plain English: A prompt is a request. Permissions are the gate in front of the action.
When the agent wants to do something, it requests a tool call: an attempt to use a capability such as reading a file or executing a command. The client checks the applicable rules before the action runs.
In Claude Code, a rule can produce three useful outcomes: an allow rule runs a matching action without asking, an ask rule requests confirmation, and a deny rule blocks it. Claude Code evaluates matching outcomes in the order deny, ask, then allow. That means a matching deny rule wins over a narrower allow rule. Anthropic documentation
This is an access-control boundary, not a claim that the agent is correct. A permitted command can still change the wrong file, expose data, or produce a bad fix.
A small example
Example: A test fails after a small validation change. You ask the agent: “Inspect the failure. Explain a minimal fix before making changes.”
First, the agent reads the test and relevant source files. Depending on the configured working directory, that read-only work may proceed without approval in Claude Code. It then proposes an edit to one validation file. You review the requested change and confirm it. Next, it asks to run the project’s specific test command. You review that request too and confirm it if it is appropriate.
The point is not to approve everything slowly. It is to make the boundary match the risk. Reading a test is different from editing a source file. Running one known test command is different from allowing arbitrary shell commands.
Try it
Take five minutes for this hypothetical exercise. Pick one tiny task in a non-critical repository, such as diagnosing one failing test. Write three columns:
- May read: files or information the agent can inspect.
- Must ask: edits or commands you want to review first.
- Must not do: actions you do not want available, such as publishing code or deleting files.
Then write a prompt that asks for a plan before changes. Compare the prompt with your three columns. The prompt describes the workflow. The permission choices decide what can happen if the agent requests an action.
Watch out
Keep permission rules narrow and understandable. Broad command patterns can allow more than you intended. A rule that matches one spelling of a command may also fail to block an equivalent command written through another path or shell wrapper; review the tool’s own matching behavior before relying on a command-text rule. Anthropic documentation
Do not treat a permission prompt as a rubber stamp. Read what the agent is requesting, especially when it writes files, changes dependencies, accesses a network, or publishes code.
Finally, do not confuse permissions with isolation. Permissions decide whether the agent client approves an action. A sandbox or virtual machine is a separate environment that can limit effects after a command runs. Claude Code advises using bypass-style permission modes only in isolated environments such as containers or virtual machines. Anthropic documentation