How Claude Code's allow, ask, and deny permissions actually work together

Claude Code's permission system uses three rule lists — allow, ask, and deny — evaluated in a fixed order where deny always wins, regardless of how specific an allow rule is. Rules are sourced from multiple settings files including project-level and user-level configs, with deny overriding across all scopes. Common pitfalls include glob patterns that match unintended commands, wrapper-stripping behavior that can bypass rules, and compound shell commands where each segment must be independently authorized. Bare tool-name denials remove a tool from the model's context entirely, while pattern-based denials like Bash(rm *) still leave the tool visible but block matching commands. The guide recommends never allowing unrestricted Bash access and treating every permission denial as useful data to refine policy over time.