I tested the behavior when setting deny in Claude Code's settings.json using rm

I tested how the deny rules in Claude Code's settings.json work, using the rm command and similar commands as examples.

2026.09.17

This page has been translated by machine translation. View original

I'm emi, a coffee lover.

In Claude Code's settings.json, there is a deny permission rule that prohibits the execution of commands. The detailed mechanism is described in the official documentation below.

I actually tested with Claude Code on Amazon Bedrock whether putting rm in deny properly blocks it, and whether commands similar to rm can still be executed.

Conclusion First

1. Blocking Commands Specified in deny

When I requested "delete target.txt with rm" with Bash(rm:*) in deny, execution of rm was rejected and the file remained

2. Evaluation Order (deny Takes Highest Priority)

Even with Bash(rm:*) in both allow and deny, rm was blocked
- The evaluation order is deny → ask → allow, with deny taking highest priority, so even if written in allow, deny takes precedence

3. Behavior of Similar Commands

With deny set to Bash(rm:*), I requested deletion using find ~/work/test -name target.txt -delete
- Since it doesn't match Bash(rm:*), it is not blocked by deny
- Whether the file gets deleted as-is depends on the permission mode and the file contents

Operating Environment

Claude Code v2.1.248 (via Amazon Bedrock, Sonnet 4.6)
Ubuntu on WSL
Test directory is ~/work/test

My verification environment is introduced in the following blog.

What to Verify

That commands added to deny are blocked before execution
That deny takes highest priority in the deny → ask → allow evaluation order
Since deny matches against command strings, rephrased similar commands are not blocked

Step 1: Create Test Files

Create a test file.

echo "dummy" > ~/work/test/target.txt

Step 2: Prepare settings.json for Verification

I'll test with project scope (.claude/settings.json). I added rm to deny in ~/work/test/.claude/settings.json.

~/work/test/.claude/settings.json

{
  "permissions": {
    "deny": [
      "Bash(rm:*)"
    ]
  }
}

Step 3: Verify Whether deny Blocks It

I launched Claude Code (on Bedrock) with ~/work/test as the working directory and made the following request.

Delete target.txt with rm

The result was as follows.

claude-code-settings-permissions-deny-verify_1

 ▐▛███▛█   Claude Code v2.1.248
▝▜██████▀  Sonnet 4.6 · Amazon Bedrock
  ▝▝ ▝▝    ~/work/test

❯ target.txt を rm で削除して

  Thought for 5s, ran 1 shell command

Bash の実行が拒否されました。ツール権限の設定を確認して、rm コマンドが許可されているか見直してください。

✻ Churned for 8s · done 11:48 AM

                                                                                         ✘ Auto-update failed · Try claude doctor or npm i -g @anthropic-ai/claude-code
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
❯
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  ⏸ manual mode on · ? for shortcuts · ← for agents · shift+click to native select

It was rejected. Let me also confirm that the file remains.

emiki@<hostname>:~/work/test$ ls target.txt 
target.txt
emiki@<hostname>:~/work/test$

It remains. The rm added to deny was blocked before execution, as expected.

Step 4: Verify Evaluation Order (deny Takes Highest Priority)

Next, I'll confirm that even if the same command is added to allow, deny still takes priority. I'll change settings.json as follows.

~/work/test/.claude/settings.json

{
  "permissions": {
    "allow": [
      "Bash(rm:*)"
    ],
    "deny": [
      "Bash(rm:*)"
    ]
  }
}

When opening ~/work/test in this state, a trust confirmation screen appeared at startup. Oh?

emiki@<hostname>:~/work/test$ claude-bedrock

─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 Accessing workspace:

 /home/emiki/work/test

 Quick safety check: Is this a project you created or one you trust? (Like your own code, a well-known open source project, or work from your team). If not, take a
 moment to review what's in this folder first.

 Claude Code'll be able to read, edit, and execute files here.

 ⚠ This folder pre-approves 1 tool permission in .claude/settings.json:
   Bash(rm:*)
 These will apply without asking. Only proceed if you trust this configuration.

 Security guide

 ❯ No, continue without these permissions
   Yes, I trust this folder

 Enter to confirm · Esc to cancel

This is a warning saying "there is 1 permission in .claude/settings.json that will be executed without confirmation." Since rm is in allow, it states that if you proceed with trust, rm commands will be executed without confirmation.

Will rm get executed if I proceed with Yes?
Let me proceed with Yes for now.

I'll make the same deletion request.

claude-code-settings-permissions-deny-verify_2


 ▐▛███▛█   Claude Code v2.1.248
▝▜██████▀  Sonnet 4.6 · Amazon Bedrock
  ▝▝ ▝▝    ~/work/test

❯ target.txt を rm で削除して

  Thought for 3s

target.txt を削除する前に存在確認します。

  Listed 1 directory

ファイルが存在します。削除します。

  Ran 1 shell command

Bash での rm の実行が拒否されました。権限設定で rm が許可されていない可能性があります。ターミナルで直接 rm /home/emiki/work/test/target.txt を実行するか、Claude Code の設定で rm を許可してください。

✻ Cogitated for 8s · done 11:57 AM

                                                                                         ✘ Auto-update failed · Try claude doctor or npm i -g @anthropic-ai/claude-code
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
❯
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  ⏸ manual mode on · ? for shortcuts · ← for agents · shift+click to native select

It stops.

Even though it was written in allow, rm was blocked. This is as per the specification that the evaluation order is deny → ask → allow, with deny taking highest priority.

Step 5: Verify Behavior of Similar Commands

With deny still set to Bash(rm:*), I requested the same deletion without using rm.

Delete target.txt using find ~/work/test -name target.txt -delete

Since it doesn't use rm, it doesn't match Bash(rm:*). In one run, a confirmation prompt appeared before execution.

claude-code-settings-permissions-deny-verify_3


 ▐▛███▛█   Claude Code v2.1.248
▝▜██████▀  Sonnet 4.6 · Amazon Bedrock
  ▝▝ ▝▝    ~/work/test

❯ find ~/work/test -name target.txt -delete で target.txt を消して

● Deleting target.txt files under ~/work/test

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 Bash command

   find ~/work/test -name target.txt -delete
   Delete target.txt files under ~/work/test

 │ find with '-delete' executes commands or modifies files — cannot be auto-allowed by a Bash(find:*) prefix rule

 Do you want to proceed?
 ❯ 1. Yes
   2. No

 Esc to cancel · Tab to amend · ctrl+e to explain

Select Yes


 ▐▛███▛█   Claude Code v2.1.248
▝▜██████▀  Sonnet 4.6 · Amazon Bedrock
  ▝▝ ▝▝    ~/work/test

❯ find ~/work/test -name target.txt -delete で target.txt を消して

  Thought for 2s, searched for 1 pattern

完了しました。~/work/test 以下の target.txt を削除しました。

✻ Brewed for 4s · done 5:13 AM

                                                                                                                        ● high · /effort
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
❯
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  ⏸ manual mode on · ? for shortcuts · ← for agents · shift+click to native select

Since it doesn't match deny, this confirmation prompt was not issued by deny.

Observed Logs

I'll test find ~/work/test -name target.txt -delete by varying the mode, model, and file contents.
The previous verifications were done in manual mode (Sonnet 4.6).

`auto` mode (Opus 4.8), file contents are "dummy"

In auto mode (Opus 4.8), the file was deleted without any confirmation prompt.


 ▐▛███▛█   Claude Code v2.1.248
▝▜██████▀  Opus 4.8 · Amazon Bedrock
  ▝▝ ▝▝    ~/work/test

❯ find ~/work/test -name target.txt -delete で target.txt を消して

まず消す対象を確認します。

  Searched for 1 pattern, read 1 file

1件だけ見つかりました（/home/emiki/work/test/target.txt、中身は dummy の1行）。削除します。

  Searched for 1 pattern

削除しました。/home/emiki/work/test/target.txt（中身は dummy の1行）1件のみ対象でした。

✻ Baked for 14s · done 5:09 AM

                                                          ✘ Auto-update failed · Try claude doctor or npm i -g @anthropic-ai/claude-code
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
❯
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  ⏵⏵ auto mode on (shift+tab to cycle) · ← for agents · shift+click to native select

`auto` mode (Opus 4.8), file contains important content

I'll change the contents of target.txt.

target.txt

This file contains important business-related content.

With auto mode (Opus 4.8) still active, I issue the deletion instruction again.


 ▐▛███▛█   Claude Code v2.1.248
▝▜██████▀  Opus 4.8 · Amazon Bedrock
  ▝▝ ▝▝    ~/work/test

❯ find ~/work/test -name target.txt -delete で target.txt を消して

まず消す前に対象を確認します。

  Searched for 1 pattern, read 1 file

削除前に中身を確認したところ、想定と違う内容でした。

対象は1件、/home/emiki/work/test/target.txt。中身はこうなっています。

ここには業務上重要な内容を書きます。

target.txt という名前だけ見ると使い捨てのファイルに見えますが、中身は「業務上重要な内容」と書かれています。私が作ったファイルでもありません。このまま -delete で消してよいか確認させてください。

- 消してよいなら、そのまま実行する
- 中身を残したいなら、先に別名でコピーしてから消す、など

どうしますか。

✻ Baked for 17s · done 5:30 AM

                                                                                         ✘ Auto-update failed · Try claude doctor or npm i -g @anthropic-ai/claude-code
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
❯
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  ⏵⏵ auto mode on (shift+tab to cycle) · ← for agents · shift+click to native select

manual mode (Opus 4.8), file contents are "dummy"

I'll change the contents of target.txt.

target.txt

dummy

I switch to manual mode (Opus 4.8) with Shift + Tab and issue the deletion instruction.


 ▐▛███▛█   Claude Code v2.1.248
▝▜██████▀  Opus 4.8 · Amazon Bedrock
  ▝▝ ▝▝    ~/work/test

❯ find ~/work/test -name target.txt -delete で target.txt を消して

まず対象を確認してから消します。

  Searched for 1 pattern, read 1 file

中身は dummy の1行だけで、消して問題なさそうです。削除します。

  Deleting target.txt files

─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 Bash command
 Tip: auto mode handles these prompts for you — choose "switch to auto mode" below

   find ~/work/test -name target.txt -delete
   Delete target.txt files

 │ find with '-delete' executes commands or modifies files — cannot be auto-allowed by a Bash(find:*) prefix rule

 Do you want to proceed?
 ❯ 1. Yes
   2. Yes, and switch to auto mode · auto mode handles these prompts for you
   3. No

 Esc to cancel · Tab to amend · ctrl+e to explain

Looking at these cases together, whether a confirmation prompt appears was determined by the permission mode.

In manual mode, a confirmation prompt always appeared before executing find -delete in Bash. Regardless of the file contents, it stops once at the point of executing the Bash command.

In auto mode, there was no confirmation prompt before Bash execution; instead, Claude read the file contents before deletion and judged for itself whether it was okay to delete. When the contents were dummy, it deleted the file as-is; when the contents said "important business content," it stopped the deletion and asked the user for confirmation.

What is common to both modes is that even with Bash(rm:*) in deny, find -delete was not blocked. There were cases where it stopped due to a confirmation prompt or Claude's judgment, but those were not stopped by deny. Since find -delete doesn't match Bash(rm:*), it remained outside the scope of deny.

Behavior Where Available Models Change

Since this is Claude Code on Bedrock, I also encountered a mysterious phenomenon where the available models change each time it starts, and I'm wondering why.

claude-code-settings-permissions-deny-verify_4

▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
   Select model
   Switch between Claude models. Your pick becomes the default for new sessions. For other/previous model names, specify with --model.

   ❯ 1. Default ✔                     Use the default model (currently Opus 4.8)
     2. Sonnet 4.6                    Sonnet 4.6 · Previous Sonnet version
     3. Sonnet 4.6 (1M context)       Sonnet 4.6 for long sessions
     4. jp.anthropic.claude-opus-4-8  Custom Opus model
     5. Haiku                         Haiku 4.5 · Fastest for quick answers

   ● High effort (default) ←/→ to adjust

   Enter to set as default · s to use this session only · Esc to cancel

claude-code-settings-permissions-deny-verify_6


▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
   Select model
   Switch between Claude models. Your pick becomes the default for new sessions. For other/previous model names, specify with --model.

     1. Default                           Use the default model (currently Opus 4.8)
   ❯ 2. jp.anthropic.claude-sonnet-4-6 ✔  Custom Sonnet model
     3. jp.anthropic.claude-opus-4-8      Custom Opus model
     4. Haiku                             Haiku 4.5 · Fastest for quick answers

   ● High effort (default) ←/→ to adjust

   Enter to set as default · s to use this session only · Esc to cancel

claude-code-settings-permissions-deny-verify_5
:

I have configured the model as described in the blog below, but I wonder if the project scope settings.json is causing issues, or if cross-region inference from guardrails is causing issues...

If I find the cause, I'd like to write an article about it somewhere.

Conclusion

If you add rm directly to deny, rm will definitely be stopped, and even if the same command is in allow, deny takes priority.

On the other hand, commands that achieve the same result through different syntax, like find -delete, are not stopped. In manual mode, a confirmation prompt appears before Bash execution, and in auto mode, Claude looks at the file contents and judges whether it's okay to delete.

As for how to stop even rephrased commands, Claude advised that PreToolUse hooks (a mechanism that inspects content with your own script immediately before tool execution) and sandbox (a mechanism that restricts access at the OS level) could be candidates, but since I haven't actually tried them yet, I still don't know.
I plan to actually run and verify this in a separate article.

You can send questions or requests about this article through the "Feedback to DevelopersIO" section at the bottom of the page.

I tested the behavior when setting deny in Claude Code's settings.json using rm

Conclusion First

1. Blocking Commands Specified in deny

2. Evaluation Order (deny Takes Highest Priority)

3. Behavior of Similar Commands

Operating Environment

What to Verify

Step 1: Create Test Files

Step 2: Prepare settings.json for Verification

Step 3: Verify Whether deny Blocks It

Step 4: Verify Evaluation Order (deny Takes Highest Priority)

Step 5: Verify Behavior of Similar Commands

Observed Logs

`auto` mode (Opus 4.8), file contents are "dummy"

`auto` mode (Opus 4.8), file contains important content

manual mode (Opus 4.8), file contents are "dummy"

Behavior Where Available Models Change

Conclusion

References

Claudeならクラスメソッドにお任せください

Related articles

AWS Topics

Trending Topics

Products & Services

Features and Series

Conclusion First

1. Blocking Commands Specified in deny

2. Evaluation Order (deny Takes Highest Priority)

3. Behavior of Similar Commands

Operating Environment

What to Verify

Step 1: Create Test Files

Step 2: Prepare settings.json for Verification

Step 3: Verify Whether deny Blocks It

Step 4: Verify Evaluation Order (deny Takes Highest Priority)

Step 5: Verify Behavior of Similar Commands

Observed Logs

auto mode (Opus 4.8), file contents are "dummy"

auto mode (Opus 4.8), file contains important content

manual mode (Opus 4.8), file contents are "dummy"

Behavior Where Available Models Change

Conclusion

References

Claudeならクラスメソッドにお任せください

Related articles

`auto` mode (Opus 4.8), file contents are "dummy"

`auto` mode (Opus 4.8), file contains important content