Permissions: enforcement vs guidance
The distinction the exam returns to again and again.
4 min read · Lesson 2 of 11 in this domain
The single most important distinction in this domain is between things that are enforced and things that are merely suggested. Settings rules and hooks are enforced by the client: they run outside the model's decision-making and apply whatever Claude concludes. CLAUDE.md is delivered to the model as text, so following it is a judgement the model makes — usually correctly, but never with a guarantee. Any exam question phrased as "must never", "always", or "guarantee" is asking you to reach for enforcement, and any answer that reaches for stronger prose is wrong.
- Three lists:
permissions.allow,permissions.ask,permissions.deny. - Rules use a
Tool(specifier)shape —Bash(npm run test *),Read(./.env),Read(./secrets/**). - Settings rules are enforced by the client regardless of what Claude decides. CLAUDE.md is context and carries no guarantee.
- So: for a hard requirement use
permissions.denyor aPreToolUsehook. For behavioural guidance use CLAUDE.md. - MCP servers have their own controls:
allowedMcpServers,deniedMcpServers(which wins),enableAllProjectMcpServers, andenabledMcpjsonServers/disabledMcpjsonServers.
| Requirement | Configure in |
|---|---|
| Block a tool, command or path | Managed settings: permissions.deny |
| Run something at a fixed lifecycle point | A hook |
| Code style and conventions | CLAUDE.md |
| Behavioural guidance | CLAUDE.md |
| Auth method / org lock | Managed settings |
Why prompt wording cannot be the control. You write "NEVER read .env files" in CLAUDE.md. It works most of the time. Then a task involves debugging a config problem, the model reasons that reading .env is the helpful next step, and it does. Nothing malfunctioned — the instruction was context competing with a plausible goal. Worse, if Claude is reading a file that itself contains injected text, the prompt is exactly the layer an attacker targets. A permissions.deny rule for Read(./.env) is evaluated by the client and cannot be reasoned around or injected past.
"Write it more forcefully in CLAUDE.md" is offered whenever a guarantee is needed. Emphasis never becomes enforcement.
You must guarantee .env is never read. Where do you enforce it?
Settings rules are client-enforced regardless of what the model decides; prose is guidance.
What is CLAUDE.md best used for?
It is context delivered to the model, so compliance is a judgement, not a guarantee.
Practise this domain with 20%%-weighted questions in the study app.
Open in study appSource: Claude Code Docs — Settings · Independent study aid, not affiliated with or endorsed by Anthropic.