Allow-lists and deny-lists get most of the attention, but Claude Code's settings.json has a third list that is often the most useful: ask. A command on it isn't blocked and isn't silently allowed. Claude stops and asks you first, every time.

The settings

Put this in .claude/settings.json:

{ "permissions": { "allow": [ "Bash(git status)", "Bash(git diff:*)", "Bash(npm test:*)" ], "ask": [ "Bash(git push:*)", "Bash(git commit:*)", "Bash(npm publish:*)" ], "deny": [ "Read(./.env)", "Read(./.env.*)" ] } }

Why "ask" beats "deny" for push

If you deny git push, the agent can never finish a task end to end, and people end up deleting the rule. If you allow it, one bad loop can push a half-finished branch. ask keeps the agent fast on everything local and puts you in front of the one step that leaves your machine.

Tips

  • Deny rules win over ask, and ask wins over allow, so you can be broad in allow and still catch the risky cases.
  • Commit .claude/settings.json so teammates get the same prompts; keep personal tweaks in .claude/settings.local.json.
  • Add git commit to ask only if you want to read every message; many people keep just push and publish.

The same three lists ship with a short CLAUDE.md, a risky-git hook and a read-only reviewer subagent in Vildanden Agent Config. The free sample is enough to set this up today.