skills.rest
rocklambros
rocklambrosCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

writing-deny-allow-rules

Create auditable YAML rule files for Claude Code permissions and action gating.

2|Updated May 23, 2026
Search Tags:#claude code#permissions#yaml frontmatter#policy rules#allow deny#path globs#bash regex
One-click install
npx skills add https://github.com/rocklambros/rcs --skill writing-deny-allow-rules
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: writing-deny-allow-rules
Source: https://github.com/rocklambros/rcs/tree/main/skills/claude-code-meta/writing-deny-allow-rules
Command: npx skills add https://github.com/rocklambros/rcs --skill writing-deny-allow-rules

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It turns ad hoc permission decisions into reviewable rule files so Claude Code can consistently allow, deny, or ask before important actions.

Core Features & Use Cases

  • One-rule-per-file policy authoring for user, project, or plugin scope.
  • Precise matchers for Bash commands and path-based write controls, including force-push blocking and sensitive directory protection.
  • Clear precedence guidance so narrower rules override broader ones when multiple files apply.
  • A built-in rationale pattern for audits, code review, and future maintainers.
  • Use it to separate declarative policy from runtime hooks and to document why a rule exists.

Quick Start

Ask Claude to help you write a reviewable rule file for the action you want to allow, deny, or prompt on, and specify the scope, tool, matcher, severity, and rationale in plain language.

Frequently Asked Questions about writing-deny-allow-rules

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write Claude Code permission rules to block force-push?▼

To block force-push in Claude Code, you create a one-rule-per-file YAML frontmatter policy. This file specifies the Bash tool, a matching regex, a deny decision, and severity to gate the action.

What is the best way to manage Claude Code permissions for sensitive directories?▼

Managing Claude Code permissions for sensitive directories uses path-based write restrictions in auditable rule files. You define path globs in the matcher field to explicitly deny Write or Edit access.

How does precedence work when applying multiple Claude Code policy files?▼

Claude Code policy precedence follows a narrower-over-broader hierarchy. When multiple rule files apply to the same tool, specific path globs and Bash regex matchers override broader, general permission rules.

Can I create Claude Code permission rules for different project scopes?▼

Yes, Claude Code permission rules support user, project, and plugin scopes. You author separate rule files for each scope to ensure action gating applies correctly based on the operational context.

Why do I need a rationale field in my Claude Code YAML frontmatter rules?▼

A rationale field in YAML frontmatter rules provides an auditable record of why a permission decision exists. This pattern supports code review, maintains policy consistency, and guides future maintainers.

Does Claude Code support gating tools other than Bash with permission rules?▼

Yes, Claude Code permission rules gate multiple tools. Beyond Bash regex matchers, you can author policy files with path globs to control Write, Edit, and Read actions across different operational scopes.

Related Skills

Explore More Software Engineering Skills→
nazrulsoftwaredevnazrulsoftwaredev

hookify-rules

Intercept bash commands, file operations, and prompts using regex-based YAML rules.

Community
Intermediate
TymorIbrahimTymorIbrahim

hookify-rules

Create and manage hookify rules with YAML configuration and regex matching.

Community
Intermediate
JackProAiJackProAi
247

hook-development

Create and manage Claude Code plugin hooks for event-driven automation.

Community
Advanced
flext-shflext-sh

lib-beartype

Manage package-wide beartype integration for flext_core runtime checks.

Official
Intermediate