2026-09-10  ·  configuration · security · devops · claudecode

I Removed an allow Rule and the Permission Was Still There

I wanted to stop auto-approving a command, so I deleted its entry from permissions.allow in my ~/.claude/settings.json.

It was still auto-approved.

Not cached, not stale — the entry existed in the project's .claude/settings.json as well, and list keys are combined rather than overridden.

Lists merge. Nothing removes another file's entries

When the same list key is set in more than one settings file, Claude Code combines the lists.

// ~/.claude/settings.json
"permissions": { "allow": ["Bash(npm run *)"] }

// .claude/settings.json  (checked into the repository)
"permissions": { "allow": ["Bash(git commit *)"] }

// → both apply

The documented intent is that each file can add entries without removing another file's. Which is reasonable, and has a consequence worth stating plainly:

No settings file can subtract from another. Not a lower level, not a higher one. Deleting your own entry removes your own entry and nothing else.

To actually stop something, use deny, or edit the file that adds it.

I had spent a while looking for a caching bug.

The level order, and the row that is actually useful

Highest first:

1  Managed settings          (organisation policy)
2  Command line              (--settings, one session)
3  .claude/settings.local.json
4  .claude/settings.json     (checked in, shared)
5  ~/.claude/settings.json

3 sits above 4, which I did not expect and now rely on. A value your team set in the shared file can be put back for you alone in settings.local.json — without editing the file everyone shares.

Nothing beats managed. Not --settings; and --model picks only from the models the organisation allows.

Environment variables are not a level

They are not in the stack at all, and which one wins is decided per key:

ANTHROPIC_MODEL           beats the model key in any file
ANTHROPIC_DEFAULT_MODEL   applies only when no file sets model

Two variables that both choose a model — one wins, one yields. There is no general rule to learn here; you check the pair for the key you care about.

An env block inside a settings file is an ordinary key and follows the five levels.

Seven keys where a lower level beats managed

For seven security-sensitive keys, Claude Code honours the more restrictive value from a scope that otherwise could not override managed settings — so a project file can tighten remoteControlAtStartup or crossSessionInbound even against organisation policy.

In one direction only. A project true for remoteControlAtStartup is ignored: you can tighten from below, never loosen. And enableArtifact cannot be turned back on — once anything sets it false, nothing restores it, managed settings included.

Four model-related keys also break the merging rule and take a whole value from one file instead. Both lists are on the reference page; what is worth carrying in your head is that the direction of the exception is not symmetric.

Why I keep writing these down

Every one of these produces the same experience: you changed the file, the behaviour did not change, and nothing told you why. The causes are different — scope, merging, precedence, an environment variable — and the symptom is identical.

Which is also why a checker cannot help with this particular one. Which files load is decided at run time, so precedence is not knowable from the files in front of you. /status shows what actually loaded; that is the tool for this.

/status         # which files were loaded
claude doctor   # the resolved settings, and any skipped rules

The five levels, the merge exceptions and the seven keys, in one table:

https://quintetkit.github.io/en/reference/claude-code-settings-precedence.html

---

I publish the configuration for splitting Claude Code into separate personas — Architect, Coder, Reviewer, Conflict Resolver — under MIT. Copy it, run ./setup.sh, and it works. It does not depend on your tech stack.

https://github.com/quintetkit/quartet

I built one real tool using nothing but this workflow. Every Issue, PR, review and merge is still there. The parts that went wrong were not deleted.

https://github.com/quintetkit/mdlinkcheck

The version that adds a UI Designer persona, review criteria, a per-Issue parallel execution script and a 11-chapter guide is on the product page.

The full kit — five personas, the scripts and the complete guide — is available here.

https://quintetkit.gumroad.com/l/quintet