Table of Contents

Introduction

settings.json decides what Claude Code may read, write, and run in a Dotkernel repo before a single word of conversation happens. The rules fall into four tiers:

  • Never read — Read denies. The contents never enter the context window at all.
  • Never written — Edit/Write denies.
  • Never run — Bash denies.
  • Ask first / allowed outright — everything else, split by risk.

The first three tiers exist to make a class of mistake structurally impossible rather than relying on Claude to remember not to do it: secrets never get read into context in the first place, dependency manifests never get silently edited, and destructive git or install commands never get silently run. The full lists are in Reference.

This is deliberately blunter than a skill. A skill can be out-argued by a sufficiently persuasive prompt; a deny rule in settings.json cannot.

Personal overrides

The ask and allow tiers are opinionated defaults, not fixed policy — see Customization for how to adjust them per machine without touching the shared file.

Where this isn't the whole story

Some commands the ask tier implies should merely prompt are blocked outright by guard-bash.sh, because the hook can see into compound Bash commands that a permission glob cannot. See Guardrails vs. Permissions.

On this page