Comprehensive Claude Code Permission Guard (settings.json)

You can always just trust that the model you use works fine out the box, but if you operate like that you are always 1 slightly ambigous prompt away from total disaster. GIT REPO (permission-guardrails) It includes broad restrictions across development and system administration. Some of the things included are based on experience. For example, I have proven that models can circumvent a denied read permission that protects secrets by executing utilitarian Powershell/Bash commands (e.g. grep). The template I linked pretty much hits most potential areas of concern and you can substract based on your personal needs. To make it easier to navigate you can show an agent my template, your development- and/or system administration plan, and then you substract until you have what you need to create a fitting (project-specific) permission guard. You can also filter out general things you do not want to happen on your local machine/environment and create a global guard as well. Co-authored by GPT-6 Astra. Use with caution if you are not familiar with command globbing. These are the sources that were used to create a README file and curate the guardrails: Claude Code Claude directory .claude/settings.json reference Settings files Settings precedence Settings reference: permissions Permission rules Permission precedence Bash matching Read/Edit path rules Configuration debugging Sandboxing Sandbox credential protection Managed settings Files, shells, and operating systems Git documentation GNU Coreutils manual Windows command reference PowerShell documentation ripgrep guide Cloud and infrastructure AWS CLI Azure CLI Google Cloud CLI Terraform CLI OpenTofu CLI Pulumi state commands Kubernetes kubectl Docker CLI Podman Helm Databases and migrations PostgreSQL psql MySQL client MongoDB mongosh Redis CLI SQLite Prisma CLI Supabase MCP Publishing and deployment npm publishing Twine uv publishing Cargo publishing Cargo yanking Cargo ownership GitHub CLI Vercel CLI Netlify CLI alias Cloudflare Wrangler Fly CLI Network and remote access OpenSSH manual rsync manual rclone copy rclone sync curl manual GNU Wget manual