{
  "_comment": "coding-agent-permission-models-compared.json - a complete Claude Code project settings file (.claude/settings.json). Rules are evaluated deny, then ask, then allow; first match wins. Commit this file so the whole team shares it; personal exceptions go in .claude/settings.local.json. Validate with: python -m json.tool coding-agent-permission-models-compared.json",
  "permissions": {
    "defaultMode": "acceptEdits",
    "allow": [
      "Read",
      "Bash(python -m pytest *)",
      "Bash(python -m unittest *)",
      "Bash(python -m ruff *)",
      "Bash(npm run lint)",
      "Bash(npm run test *)",
      "Bash(git status *)",
      "Bash(git diff *)",
      "Bash(git log *)",
      "Bash(git add *)",
      "Bash(git commit *)",
      "WebFetch(domain:docs.python.org)"
    ],
    "ask": [
      "Bash(git push *)",
      "Bash(git clean *)",
      "Bash(pip install *)",
      "Bash(npm install *)",
      "Edit(./migrations/**)"
    ],
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)",
      "Bash(rm -rf *)",
      "Bash(curl *)",
      "Bash(wget *)",
      "Bash(git push --force *)",
      "WebSearch"
    ],
    "additionalDirectories": []
  },
  "sandbox": {
    "enabled": true,
    "autoAllowBashIfSandboxed": true
  }
}