Stop Clicking 'Approve': A .claude/settings.json Template for 80% Fewer

The Permission Friction Problem

If you use Claude Code daily, you know the drill: you ask it to run a test, it needs approval. You ask it to install a package, it needs approval. You ask it to check a git log, it needs approval. This security-first design is crucial, but the constant interruptions train you to click 'Approve' without reading, defeating the purpose. The solution isn't to disable security—it's to configure it intelligently using the project-scoped .claude/settings.json file.

The Configuration: A Curated Allow List

The core of the strategy is a JSON file that defines a permissions.allow array. This is not a blanket "allow all"; it's a carefully considered list of command patterns you trust for your specific project context. Here is a robust starter template you can drop into your project's .claude/ directory:

{
  "permissions": {
    "allow": [
      "Bash(git *)",
      "Bash(python manage.py *)",
      "Bash(python3 manage.py *)",
      "Bash(pip *)",
      "Bash(pip3 *)",
      "Bash(npm *)",
      "Bash(npx *)",
      "Bash(gh *)",
      "Bash(docker *)",
      "Bash(docker-compose *)",
      "Bash(celery *)",
      "Bash(ls *)",
      "Bash(cd *)",
      "Bash(cat *)",
      "Bash(mkdir *)",
      "Bash(cp *)",
      "Bash(mv *)",
      "Bash(source *)",
      "Bash(python3 *)"
    ]
  }
}

How To Apply It: Step-by-Step

1. Create the directory and file: In your project root, run:

   mkdir -p .claude && touch .claude/settings.json
   

2. Paste the configuration: Copy the JSON above into the new file.
3. Customize for your stack: Remove lines you don't need (e.g., celery if you don't use it).
4. Consider narrowing broad rules: The template uses broad patterns like git * and python3 * for speed. For shared or sensitive projects, you can narrow them. For example:

   "Bash(git status)",
   "Bash(git add)",
   "Bash(git commit)",
   "Bash(git log)",
   "Bash(python3 manage.py *)" // More specific than python3 *
   

5. Commit it (optional): Adding .claude/settings.json to your repository standardizes permissions across your team, ensuring everyone has the same efficient, secure baseline.

The Critical Exclusions: Your Safety Net

The power of this approach lies as much in what you don't allow. The template deliberately excludes high-risk commands, ensuring Claude Code will always stop and ask for explicit approval before running them. These include:

• rm: Irreversible file deletion.
• curl / wget: Downloading and potentially executing remote content.
• chmod / chown: Changing file permissions and ownership.
• sudo: Privilege elevation—never auto-approve this.
• kill / pkill: Terminating processes.
• ssh / scp: Remote system access.

This creates a safe sandbox. Claude can autonomously handle the 80% of commands that are routine (version control, package management, running scripts) while you remain in the loop for the 20% that are potentially destructive.

The Result: A More Agentic Workflow

With this configuration, Claude Code transforms from a tool that asks for permission at every step into a capable junior developer. It can execute multi-step plans—like "run tests, diagnose the failure, apply a fix, and run tests again"—without breaking your flow. The reduction in cognitive load and context-switching is immediate and significant. You maintain security where it counts and gain velocity where it matters.