权限系统详解

Claude Code具有强大的权限系统，让你能够精确控制Claude可以执行的操作。本节介绍如何配置和管理权限。

权限概述

Claude Code默认会在执行敏感操作前请求确认。权限系统让你可以：

• 预设允许/禁止的操作
• 限制文件访问范围
• 控制命令执行权限

查看权限

/permissions

输出示例：

当前权限规则：
┌─────────────────┬────────────┬─────────────┐
│ 规则            │ 类型       │ 来源        │
├─────────────────┼────────────┼─────────────┤
│ Allow: Read(*)  │ 允许       │ 默认        │
│ Allow: Edit(*)  │ 允许       │ 用户配置    │
│ Deny: Edit(.env)│ 禁止       │ 项目配置    │
│ Ask: Bash(rm)   │ 询问       │ 用户配置    │
└─────────────────┴────────────┴─────────────┘

权限配置

配置文件位置

# 用户级权限
~/.claude/settings.json

# 项目级权限
./.claude/settings.json

权限规则格式

{
  "permissions": {
    "allow": ["规则1", "规则2"],
    "deny": ["规则3"],
    "ask": ["规则4"]
  }
}

权限类型

类型	说明
allow	自动允许，不询问
deny	自动拒绝
ask	每次询问用户

命令权限

允许特定命令

{
  "permissions": {
    "allow": [
      "Bash(npm)",
      "Bash(git)",
      "Bash(node)"
    ]
  }
}

禁止危险命令

{
  "permissions": {
    "deny": [
      "Bash(rm -rf)",
      "Bash(sudo)",
      "Bash(chmod 777)",
      "Bash(dd)"
    ]
  }
}

询问确认

{
  "permissions": {
    "ask": [
      "Bash(git push)",
      "Bash(npm publish)"
    ]
  }
}

文件权限

允许访问目录

{
  "permissions": {
    "allow": [
      "Read(./src/**)",
      "Edit(./src/**)",
      "Write(./src/**)"
    ]
  }
}

禁止访问敏感文件

{
  "permissions": {
    "deny": [
      "Read(.env*)",
      "Edit(.env*)",
      "Read(**/secrets/**)",
      "Edit(**/secrets/**)"
    ]
  }
}

只读权限

{
  "permissions": {
    "allow": [
      "Read(./docs/**)"
    ],
    "deny": [
      "Edit(./docs/**)",
      "Write(./docs/**)"
    ]
  }
}

工具权限

允许特定工具

{
  "permissions": {
    "allow": [
      "Read",
      "Edit",
      "Bash(npm test)"
    ]
  }
}

禁止特定工具

{
  "permissions": {
    "deny": [
      "Bash(curl)",
      "Bash(wget)"
    ]
  }
}

完整配置示例

{
  "permissions": {
    "allow": [
      "Read(**)",
      "Edit(./src/**)",
      "Edit(./tests/**)",
      "Write(./src/**)",
      "Write(./tests/**)",
      "Bash(npm)",
      "Bash(git)",
      "Bash(node)",
      "Bash(npx)"
    ],
    "deny": [
      "Read(.env*)",
      "Edit(.env*)",
      "Write(.env*)",
      "Read(**/secrets/**)",
      "Bash(rm -rf)",
      "Bash(sudo)",
      "Bash(chmod 777)"
    ],
    "ask": [
      "Bash(git push)",
      "Bash(git push --force)",
      "Bash(npm publish)",
      "Write(./package.json)"
    ]
  }
}

权限规则语法

通配符

*      匹配任意字符（不含路径分隔符）
**     匹配任意字符（含路径分隔符）
?      匹配单个字符
[abc]  匹配a、b或c

示例

{
  "permissions": {
    "allow": [
      "Read(./src/**/*.ts)",      // src下所有ts文件
      "Edit(./src/**/test_*.py)", // src下test_开头的py文件
      "Bash(npm run*)"            // npm run开头的命令
    ]
  }
}

跳过权限确认

临时跳过

# 在当前会话跳过所有权限确认
claude --dangerously-skip-permissions

警告

使用 --dangerously-skip-permissions 会跳过所有安全检查，仅建议在受信任的环境中使用。

配置自动接受

{
  "autoAcceptPermissions": true
}

企业级权限配置

审计日志

结合Hooks记录所有操作：

{
  "hooks": {
    "PreToolUse": [{
      "matcher": "*",
      "hooks": [{
        "type": "command",
        "command": "echo \"$(date '+%Y-%m-%d %H:%M:%S') | Tool: $CLAUDE_TOOL_NAME | Input: $CLAUDE_TOOL_INPUT\" >> /var/log/claude-audit.log"
      }]
    }]
  }
}

严格的权限配置

{
  "permissions": {
    "allow": [
      "Read(./src/**)",
      "Read(./tests/**)",
      "Edit(./src/**)",
      "Bash(npm run test)",
      "Bash(npm run lint)"
    ]
  },
  "autoAcceptPermissions": false
}

权限优先级

规则按以下优先级处理：

1. deny 规则 - 最高优先级
2. ask 规则
3. allow 规则
4. 默认行为 - 询问用户

常见配置场景

场景一：只读分析

{
  "permissions": {
    "allow": [
      "Read(**)",
      "Bash(git log)",
      "Bash(git diff)"
    ],
    "deny": [
      "Edit(**)",
      "Write(**)",
      "Bash(git push)"
    ]
  }
}

场景二：前端开发

{
  "permissions": {
    "allow": [
      "Read(**)",
      "Edit(./src/**)",
      "Edit(./public/**)",
      "Write(./src/**)",
      "Bash(npm *)",
      "Bash(npx *)"
    ],
    "deny": [
      "Edit(.env*)",
      "Bash(rm -rf node_modules)"
    ]
  }
}

场景三：CI/CD环境

{
  "permissions": {
    "allow": [
      "Read(**)",
      "Bash(npm ci)",
      "Bash(npm run build)",
      "Bash(npm run test)"
    ],
    "deny": [
      "Edit(**)",
      "Write(**)"
    ]
  },
  "autoAcceptPermissions": true
}

下一步

学会了权限配置后，继续学习 Headless模式与自动化。