writing-deny-allow-rules

Create auditable YAML rule files for Claude Code permissions and action gating.

2|Updated May 23, 2026

Search Tags:#claude code #permissions #yaml frontmatter #policy rules #allow deny #path globs #bash regex

Ready to run

npx skills add https://github.com/rocklambros/rcs --skill writing-deny-allow-rules

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: writing-deny-allow-rules
Source: https://github.com/rocklambros/rcs/tree/main/skills/claude-code-meta/writing-deny-allow-rules
Command: npx skills add https://github.com/rocklambros/rcs --skill writing-deny-allow-rules

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It turns ad hoc permission decisions into reviewable rule files so Claude Code can consistently allow, deny, or ask before important actions.

Core Features & Use Cases

One-rule-per-file policy authoring for user, project, or plugin scope.
Precise matchers for Bash commands and path-based write controls, including force-push blocking and sensitive directory protection.
Clear precedence guidance so narrower rules override broader ones when multiple files apply.
A built-in rationale pattern for audits, code review, and future maintainers.
Use it to separate declarative policy from runtime hooks and to document why a rule exists.

Quick Start

Ask Claude to help you write a reviewable rule file for the action you want to allow, deny, or prompt on, and specify the scope, tool, matcher, severity, and rationale in plain language.

Frequently Asked Questions about writing-deny-allow-rules

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I write Claude Code permission rules to block force-push?▼

To block force-push in Claude Code, you create a one-rule-per-file YAML frontmatter policy. This file specifies the Bash tool, a matching regex, a deny decision, and severity to gate the action.

What is the best way to manage Claude Code permissions for sensitive directories?▼

Managing Claude Code permissions for sensitive directories uses path-based write restrictions in auditable rule files. You define path globs in the matcher field to explicitly deny Write or Edit access.

How does precedence work when applying multiple Claude Code policy files?▼

Claude Code policy precedence follows a narrower-over-broader hierarchy. When multiple rule files apply to the same tool, specific path globs and Bash regex matchers override broader, general permission rules.

Can I create Claude Code permission rules for different project scopes?▼

Yes, Claude Code permission rules support user, project, and plugin scopes. You author separate rule files for each scope to ensure action gating applies correctly based on the operational context.

Why do I need a rationale field in my Claude Code YAML frontmatter rules?▼

A rationale field in YAML frontmatter rules provides an auditable record of why a permission decision exists. This pattern supports code review, maintains policy consistency, and guides future maintainers.

Does Claude Code support gating tools other than Bash with permission rules?▼

Yes, Claude Code permission rules gate multiple tools. Beyond Bash regex matchers, you can author policy files with path globs to control Write, Edit, and Read actions across different operational scopes.