I verified a method to prevent Claude Code itself from overwriting settings.json ~ About deny rules and protected paths

I'm a coffee lover, emi.

Claude Code's settings.json has a deny permission rule that prohibits command execution. The detailed mechanism is described in the official documentation below.

https://code.claude.com/docs/en/permissions/

https://dev.classmethod.jp/articles/claude-code-settings-permissions-deny-verify/

I was thinking about whether it would be possible to prevent Claude itself from rewriting settings.json when using Claude Code. So I tried writing rules in permissions.deny of settings.json to see if I could prevent Claude Code itself from rewriting settings.json.
I'll share what I found through research and what I confirmed through actual behavior testing.

Conclusion First

1. Denying Edit blocks file operations via Edit

• Adding Edit(//**/.claude/settings.json) to deny blocked rewrites via Edit / Write in all 3 modes tested
• It stops with Error editing file without even showing a prompt

2. Write with Edit, not Write

• Only Edit(path) and Read(path) are subject to file permission checks
  • Writing Write(...) is not referenced and produces a warning at startup
• Edit(...) applies to all built-in tools that edit files, so writing just Edit(...) covers the Write tool as well

3. .claude is protected as a protected path even without deny, but behavior changes depending on the permission mode, so be careful

• .claude/settings.json is protected as a protected path even without writing deny
• However, protected paths behave differently by mode: auto routes to the classifier, while bypassPermissions allows it

4. Bash-based operations cannot be blocked by just denying Edit

• Edit(...) in deny stops Edit / Write routes, but does not block file editing via Bash (such as sed -i or writing with python)
• The official documentation recommends adding commands to Bash(...) in deny, or using sandboxes or PreToolUse hooks that don't depend on command strings, if you also want to block Bash-based operations (Configure permissions)

Verification Environment

• Claude Code v2.1.248
• Amazon Bedrock (Opus 4.8)
• Test project ~/work/test

This time I experimented using the project-scoped ~/work/test/.claude/settings.json.

What I Was Initially Thinking

At first I was thinking of listing commands in deny like this.

{
  "permissions": {
    "deny": [
      "<write the commands that rewrite settings.json here>"
    ]
  }
}

But I thought it wasn't realistic to cover all the rewriting commands. Also, I found that there are 2 ways Claude can rewrite files.

2 Ways Claude Code Rewrites Files

There are two main ways Claude Code rewrites files.

https://code.claude.com/docs/ja/permissions#permission-system

• 1. Via Edit
  • Using Claude Code's dedicated file editing tools (Edit / Write)
• 2. Via Bash
  • Rewriting files by executing shell commands in the terminal
  • Such as echo '{}' > ~/.claude/settings.json, sed -i 's/old/new/' ~/.claude/settings.json, python3 -c "open('~/.claude/settings.json','w').write('...')", etc.

Writing Edit(...) in deny rules can block editing via Edit, but it cannot block file editing via Bash command execution, so if you also want to block Bash-based file editing, you need to add it separately like Bash(sed:*).

In other words, the approach I initially considered of listing commands in deny can only restrict Bash-based file editing (and covering all cases is practically impossible).

The settings.json I Set Up Initially

So I tried setting up .claude/settings.json as follows.

{
  "permissions": {
    "deny": [
      "Edit(//**/.claude/settings.json)",
      "Write(//**/.claude/settings.json)"
    ]
  }
}

The path inside Edit(...) is specified in a format similar to gitignore. How to specify paths is also described in Read and Edit.

• Starting with //
  • Becomes an absolute path from the filesystem root, meaning "anywhere on the machine"
• **
  • A wildcard that matches any number of intermediate folder levels

So //**/.claude/settings.json means "match any file ending in .claude/settings.json anywhere on the machine." This time I wanted to cover both the user-scoped settings.json and the project-scoped settings.json, so I wrote it this way.
Specifically, it matches both of the following.

• ~/work/test/.claude/settings.json (project scope)
• ~/.claude/settings.json (user scope)

How to Write deny to Reject File Editing

When I started Claude Code on Bedrock, the following message appeared at startup.

emiki@<hostname>:~/work/test$ claude-bedrock
Enter MFA code for <arn>: xxxxxx
Permission deny rule (.claude/settings.json): Write(//**/.claude/settings.json) is not matched by file permission checks — only Edit(path) rules are. Use Edit(//**/.claude/settings.json) instead (Edit rules cover all file-editing tools).
:
emiki@<hostname>:~/work/test$ 

It says that Write(//**/.claude/settings.json) is not subject to file permission checks. Only Edit(path) rules are subject to permission checks, and since Edit rules cover all file-editing tools, please use Edit(//**/.claude/settings.json).

Looking it up more carefully, I found that it was also stated in the documentation that Claude Code's file permission checks only look at Edit(path) and Read(path) rules.

Edit rules apply to all built-in tools that edit files.

Claude Code only checks file permissions against Edit(path) and Read(path) rules. If you instead write path rules for the Write, NotebookEdit, Glob, or legacy MultiEdit tools, Claude Code will accept the rules but never consult them, and will display a warning at startup.

https://code.claude.com/docs/ja/permissions#read-and-edit

Since the Write tool is also included in "all built-in tools that edit files," the mechanism is that writing just Edit(...) covers writes via the Write tool as well.

After modifying settings.json as follows, the warning no longer appeared.

{
  "permissions": {
    "deny": [
      "Edit(//**/.claude/settings.json)"
    ]
  }
}

Verifying Whether settings.json Editing Gets Blocked

I chose cleanupPeriodDays as the key to add. Since it's a number, it's easy to see at a glance whether it was added, and it's a mostly harmless setting for how many days to retain chat history. The default is 30 (cleanupPeriodDays). To make it easy to tell if something was added, I'll have 45 appended in the verification.

I'll ask Claude Code to do this:

Add `"cleanupPeriodDays": 45` to `.claude/settings.json`

and see if it gets rewritten.

Verification 1: auto Mode

First I tried in auto mode.

 ▐▛███▛█   Claude Code v2.1.248
▝▜██████▀  Opus 4.8 · Amazon Bedrock
  ▝▝ ▝▝    ~/work/test

❯ .claude/settings.json に "cleanupPeriodDays": 45 を追記して

  Read 1 file

● Update(.claude/settings.json)
Error editing file

.claude/settings.json 自体に、この設定ファイルの編集を禁止する deny ルールが入っていて、編集がブロックされました。

"deny": [
  "Edit(//**/.claude/settings.json)"
]

このルールが有効なままだと、私からは .claude/settings.json を書き換えられない。回避策として Bash で直接書き込むこともできるが、それはあなたが設定した禁止ルールをすり抜けることになるので、勝手にはやらない。

進め方の選択肢:

- deny ルールを一時的に外す（またはこのファイルを対象から除外する）→ そのうえで私が cleanupPeriodDays: 45 を追記
- あなた自身が追記する。プロンプトに次を貼れば、このセッションで実行できる

! python3 -c "import json,pathlib; p=pathlib.Path('/home/emiki/work/test/.claude/settings.json'); d=json.loads(p.read_text()); d['cleanupPeriodDays']=45; p.write_text(json.dumps(d, indent=2, ensure_ascii=False)+'\n')"

どちらで進めるか教えてください。

✻ Sautéed for 29s · done 7:55 AM

※ recap: .claude/settings.json に cleanupPeriodDays: 45 を追記したいが、同ファイルが deny ルールで編集ブロックされている。次は、deny ルールを外すかユーザー自身で追記するか、進め方の返答を待つ。 (disable recaps in /config)

                                                                                         ✘ Auto-update failed · Try claude doctor or npm i -g @anthropic-ai/claude-code
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
❯
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  ⏵⏵ auto mode on (shift+tab to cycle) · ← for agents · shift+click to native select

Claude tried to write using the Update (Edit) tool and the edit was blocked by the deny rule, resulting in Error editing file.

In auto mode, it stopped, judging that "Bash could be used to write directly and bypass the restriction, but since that would circumvent the prohibition rule you set, I won't do it without permission."

Verification 2: bypassPermissions Mode

Next, I tried in bypassPermissions mode, which never asks for permission.

https://code.claude.com/docs/ja/permission-modes#skip-all-checks-with-bypasspermissions-mode

I'll check whether the deny properly blocks it when there is no model judgment like in auto mode.

A warning appeared at startup.

emiki@<hostname>:~/work/test$ claude-bedrock --permission-mode bypassPermissions

─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  WARNING: Claude Code running in Bypass Permissions mode

  In Bypass Permissions mode, Claude Code will not ask for your approval before running potentially dangerous commands.
  This mode should only be used in a sandboxed container/VM that has restricted internet access and can easily be restored if damaged.

  By proceeding, you accept all responsibility for actions taken while running in Bypass Permissions mode.

  https://code.claude.com/docs/en/security

  ❯ No, exit
    Yes, I accept

  Enter to confirm · Esc to cancel

It says you're running in bypassPermissions mode, please make sure you're in an environment where something going wrong is okay, and that you accept all responsibility for anything that happens.

This time I nervously selected Yes, I accept and proceeded.

 ▐▛███▛█   Claude Code v2.1.248
▝▜██████▀  Opus 4.8 · Amazon Bedrock
  ▝▝ ▝▝    ~/work/test

❯ .claude/settings.json に "cleanupPeriodDays": 45 を追記して

  Read 1 file

● Update(.claude/settings.json)
Error editing file

予想どおり、この settings.json 自体に編集を禁止するルールが入っていて、Edit がブロックされました。

"deny": [
  "Edit(//**/.claude/settings.json)"
]

このルールがある以上、私（Claude）からは .claude/settings.json を編集できません。次のどちらかで対応してください。

- 自分でファイルを開いて "cleanupPeriodDays": 45, を追記する。編集後は次のようになる：

{
  "permissions": {
    "deny": [
      "Edit(//**/.claude/settings.json)"
    ]
  },
  "cleanupPeriodDays": 45
}

- deny ルールごと私に編集させたいなら、先にこのルールを外す（外すのも同じ理由で私からはできないので、手動で消す必要がある）

どうするか決めてもらえれば、それに合わせて進めます。

✻ Brewed for 17s · done 8:50 AM

                                                                                         ✘ Auto-update failed · Try claude doctor or npm i -g @anthropic-ai/claude-code
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
❯
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  ⏵⏵ bypass permissions on (shift+tab to cycle) · ← for agents · shift+click to native select

It properly stopped.

Verification 3: acceptEdits Mode

acceptEdits mode is a mode that automatically approves file editing, mkdir, touch, rm, rmdir, mv, cp, and sed (Auto-approve file edits with acceptEdits mode). It's a mode that says "I'll leave general file editing tool usage and common file operations like file creation to Claude, but please confirm with a human for curl and other command executions."

https://code.claude.com/docs/ja/permission-modes#auto-approve-file-edits-with-acceptedits-mode

In addition to file edits, acceptEdits mode auto-approves common filesystem Bash commands: mkdir, touch, rm, rmdir, mv, cp, sed.

Since common Bash commands are automatically approved without prompting, I was going to try it, but while looking at the documentation, I found the following note.

Paths outside that scope, writes to protected paths, deletions by rm and rmdir targeting critical paths, and all other Bash commands except a built-in set of read-only commands will still prompt you.

Protected paths…? Critical paths…?

Could it be that settings.json is already protected from the start?

.claude is also a protected path (protected paths)

Claude Code has a mechanism called protected paths, and the .claude directory is included there. Writes are not automatically approved except in modes like bypassPermissions. It's a mechanism to prevent the repository state and Claude's own settings from being accidentally broken.

https://code.claude.com/docs/ja/permission-modes#protected-paths

Comparing Edit / Write to regular files (within the working directory) versus Edit / Write to protected paths (protected paths):
What's being compared here is file editing by Edit / Write tools (shell command routes like sed or python are handled differently).

※ plan mode is originally a mode that blocks source file editing, and since explaining its behavior in detail would be lengthy, it's not covered in this article.

In the official documentation's classifier evaluation order (How the classifier evaluates actions), read-only operations and file edits within the working directory are automatically approved, but writes to protected paths and the first read outside the working directory are exceptions that prompt for confirmation.

Read-only actions and file edits in your working directory are auto-approved, except writes to protected paths and the first read outside the working directories, which prompts you
Everything else goes to the classifier.

Shell commands like sed, echo, and python fall under this "everything else," so they go to the classifier even for writes to regular files. The "auto-approved (passes through without classifier)" in the table applies only to Edit / Write cases.

In verification 2, bypassPermissions should "allow" even protected paths, but thanks to deny, Edit was properly stopped.

I tested the behavior of acceptEdits mode with and without deny written in the permission rules.

With deny

With deny in place, when asked in acceptEdits (⏵⏵ accept edits on) mode, Edit was blocked.

 ▐▛███▛█   Claude Code v2.1.248
▝▜██████▀  Opus 4.8 · Amazon Bedrock
  ▝▝ ▝▝    ~/work/test

❯ .claude/settings.json に "cleanupPeriodDays": 45 を追記して

  Read 1 file

● Update(.claude/settings.json)
Error editing file

予想どおり編集がブロックされました。この settings.json 自体に Edit(//**/.claude/settings.json) の deny ルールがあり、Edit / Write でこのファイルを書き換えられません。

対応方法は次のどちらか。

- あなたのターミナルで直接実行する（! プレフィックスでこのセッションから実行可能）

! python3 -c "import json,pathlib; p=pathlib.Path('.claude/settings.json'); d=json.loads(p.read_text()); d['cleanupPeriodDays']=45; p.write_text(json.dumps(d, indent=2, ensure_ascii=False)+'\n')"

- deny ルールを一時的に外してよいなら、.claude/settings.json の deny から該当行を削除したうえで、再度私に依頼する

追記後の内容は次のようになる。

{
  "permissions": {
    "deny": [
      "Edit(//**/.claude/settings.json)"
    ]
  },
  "cleanupPeriodDays": 45
}

どちらで進めるか教えてください。

✻ Cooked for 16s · done 9:34 AM
                                                                                         ✘ Auto-update failed · Try claude doctor or npm i -g @anthropic-ai/claude-code
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
❯
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  ⏵⏵ accept edits on (shift+tab to cycle) · ← for agents · shift+click to native select

It shows that it was blocked by deny.

Without deny

Next I emptied deny.

{
  "permissions": {
    "deny": []
  }
}

❯ .claude/settings.json に "cleanupPeriodDays": 45 を追記して

deny ルールで Edit / Write は使えないので、Bash から書き換えます。

● Adding cleanupPeriodDays to settings.json via python
  ⎿  $ python3 -c "import json,pathlib; p=pathlib.Path('/home/emiki/work/test/.claude/settings.json'); d=json.loads(p.read_text()); d['cleanupPeriodDays']=45; p.write_text(json.dumps(d, indent=2, ensure_ascii=False)+'\n')" && cat /home/emiki/work/test/.claude/settings.json

─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 Bash command
 Tip: auto mode handles these prompts for you — choose "switch to auto mode" below

   │ python3 -c "import json,pathlib; p=pathlib.Path('/home/emiki/work/test/.claude/settings.json'); d=json.loads(p.read_text()); d['cleanupPeriodDays']=45; p.write_text(json.dumps(d, indent=2, ensure_ascii=False)+'\n')" && cat /home/emiki/work/test/.claude/settings.json
   Add cleanupPeriodDays to settings.json via python

 This command requires approval

 Do you want to proceed?
 ❯ 1. Yes
   2. Yes, and don't ask again for: python3 *
   3. Yes, and switch to auto mode · auto mode handles these prompts for you
   4. No

 Esc to cancel · Tab to amend · ctrl+e to explain

Hmm…?
It's saying it can't edit because of the deny rule…

The official documentation When edits take effect says that permissions edits are applied without restart, but perhaps they haven't been applied yet.

Claude Code watches the settings files and reloads them on changes, so most edits, including edits to permissions, hooks, and credential helpers such as apiKeyHelper, are applied to a running session without restart.

https://code.claude.com/docs/ja/settings#when-edits-take-effect

I'll stop the operation with No for now and try again.

❯ .claude/settings.json に "cleanupPeriodDays": 45 を追記して

Bash も止められたので、私から書き換える手段が残っていません（Edit / Write は deny ルールでブロック、Bash は今拒否されました）。

進め方を選んでください。

- あなたのターミナルで直接実行する。この入力欄に次を貼れば、このセッションから実行できます

! python3 -c "import json,pathlib; p=pathlib.Path('.claude/settings.json'); d=json.loads(p.read_text()); d['cleanupPeriodDays']=45; p.write_text(json.dumps(d, indent=2, ensure_ascii=False)+'\n')"

- deny ルールを一時的に外す。.claude/settings.json の deny から Edit(//**/.claude/settings.json) を消してから再依頼
- 私が Bash で書き換えるのを許可する（さっきのコマンドを承認する）

どれにしますか。

✻ Sautéed for 11s · done 9:41 AM
                                                                                         ✘ Auto-update failed · Try claude doctor or npm i -g @anthropic-ai/claude-code
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
❯
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  ⏵⏵ accept edits on (shift+tab to cycle) · ← for agents · shift+click to native select

Hmm, it's still saying it can't edit because of the deny rule. I'll exit the session with /exit for now, restart Claude Code, switch to acceptEdits (⏵⏵ accept edits on) mode, and try again.

 ▐▛███▛█   Claude Code v2.1.248
▝▜██████▀  Opus 4.8 · Amazon Bedrock
  ▝▝ ▝▝    ~/work/test

❯ .claude/settings.json に "cleanupPeriodDays": 45 を追記して

  Read 2 files

● Update(.claude/settings.json)

─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 Edit file
 .claude/settings.json
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌
{
  "permissions": {
    "deny": []
-  }
+  },
+  "cleanupPeriodDays": 45
}
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌
 Do you want to make this edit to settings.json?
 ❯ 1. Yes
   2. Yes, and allow Claude to edit its own settings for this session
   3. No

 Esc to cancel · Tab to amend

As described in protected paths, the option Yes, and allow Claude to edit its own settings for this session is displayed.

When prompting for writes to .claude/, the option Yes, and allow Claude to edit its own settings for this session is shown, which auto-approves subsequent .claude/ writes within that session without prompting again.

This time I'll cancel with No.

With this, I was able to confirm the behavior.
With deny, Edit is immediately blocked with Error editing file without even showing a prompt. Without deny, in acceptEdits mode, Edit is not blocked, and the protected path confirmation prompt appears.

The official documentation When edits take effect says that permissions edits are applied without restart. This time it didn't appear to be the case, which is a mystery. As similar reports, I found multiple issues where permission changes in settings.json were not reflected in a running session and required a restart (#30737, #33829, #53538). I wasn't able to identify the cause.

What I Found Out

※Repeated from above

1. Denying Edit blocks file operations via Edit

• Adding Edit(//**/.claude/settings.json) to deny blocked rewrites via Edit / Write in all 3 modes tested
• It stops with Error editing file without even showing a prompt

2. Write with Edit, not Write

• Only Edit(path) and Read(path) are subject to file permission checks
  • Writing Write(...) is not referenced and produces a warning at startup
• Edit(...) applies to all built-in tools that edit files, so writing just Edit(...) covers the Write tool as well

3. .claude is protected as a protected path even without a deny, but behavior varies depending on the permission mode, so caution is advised

• .claude/settings.json is protected as a protected path (protected paths) even without writing a deny
• However, the behavior of protected paths changes depending on the mode: auto routes to the classifier, while bypassPermissions allows access

4. Simply adding deny for Edit cannot block operations via Bash

• Edit(...) in deny only stops access via Edit / Write, and cannot block operations via Bash (such as writing with sed -i or python)
• To block operations via Bash as well, the official documentation recommends either adding commands to the deny for Bash(...), or using a sandbox or PreToolUse hook that does not depend on command strings (Configure permissions)

Closing

If you want to prevent Claude Code from rewriting settings.json, the clearest approach is to add one line with Edit(//**/.claude/settings.json) to the deny list.
I also learned that .claude is already slightly protected as a protected path (protected paths) by default.

I hope this is helpful for anyone else who has been troubled by settings.json being modified without their knowledge.

For questions or requests about this article, please contact us via the "Feedback for DevelopersIO" section at the bottom of the page.