◆ Sparround

Permissions and safe operating modes

The agent edits files and runs commands on your behalf, so the permission system is the tool's security model. There are two mechanisms:

1. Permission modes set the session's overall behaviour:

  • default (Manual in the UI) — asks on first use of each tool.
  • plan — the agent reads and explores but does not change source files.
  • acceptEdits — auto-accepts file edits and common filesystem commands such as mkdir and mv.
  • auto — auto-approves actions with background safety checks.
  • dontAsk — denies anything not in your allow rules (useful for locked-down CI runs).
  • bypassPermissions — skips prompts. Only in an isolated environment (container, VM).

2. Permission rules — allow / ask / deny lists for specific tools and commands.

json
{
  "permissions": {
    "allow": [
      "Bash(./gradlew :app:compileDebugKotlin)",
      "Bash(./gradlew :app:testDebugUnitTest)",
      "Bash(./gradlew lint*)",
      "Bash(git status *)",
      "Bash(git diff *)",
      "Bash(git log *)"
    ],
    "ask": [
      "Bash(git commit *)",
      "Bash(git push *)"
    ],
    "deny": [
      "Bash(./gradlew publish*)",
      "Read(./local.properties)",
      "Read(./**/*.jks)",
      "Read(./**/google-services.json)"
    ]
  }
}

`.claude/settings.json` — permission rules for an Android project. Committed to the repo so the whole team starts from the same baseline.

Rule syntaxWhat it matches
`Bash`All shell commands
`Bash(./gradlew test*)`Commands starting with `./gradlew test` (prefix match)
`Read(./local.properties)`Reading that specific file
`WebFetch(domain:example.com)`Requests to that domain

Precedence is deny-first: a deny rule beats an allow rule. That lets you block a specific dangerous command even when Bash is allowed wholesale. deny rules set at the organisation level cannot be overridden by a developer's own configuration.

Files that need special attention in an Android project:

  • local.properties — the SDK path, sometimes keys.
  • *.jks, *.keystore — signing keys.
  • google-services.json, *.p8, *.p12 — service configuration and certificates.
  • gradle.properties — sometimes holds publishing credentials.

Putting these in the deny list prevents both accidental reads and the content entering the context (and from there, a model request).

📚 Sources and documentation