manage-sandbox-allowlist

You can unblock a command by adding its specific Bash, Read, or Edit pattern to the allowlist in your ~/.claude/settings.json file, which applies the permission change directly to your local development environment.

The allowlist and denylist mechanism works by defining permission patterns in ~/.claude/settings.json, where allowlist entries enable specific Bash commands and denylist entries restrict access to risky commands or sensitive paths.

The best way to manage sandbox permissions is to tune the allowlist and denylist patterns in ~/.claude/settings.json, validating changes against conflicts and reviewing a diff before applying edits to your local development environment.

Yes, you can restrict access to sensitive file paths by adding Read(<path>) and Edit(<path>) patterns to the denylist in your ~/.claude/settings.json file, which protects sensitive data from unauthorized access or modification.

Claude Code blocks CLI tools that do not match existing allowlist patterns in your settings.json. You can remediate the blocked command by proposing and applying the exact allowlist pattern to regain your workflow with minimal disruption.