Agent Permissions Generator

Choose an agent and a preset and get its permission file with strict defaults: what the agent may do on its own, what it must ask, and what it may never do. Written in your browser, with the tool version and documentation it follows.

This is not a complete security layer: it limits what the agent does on its own, not what a command, a dependency or a person can do. Use a sandbox or a separate machine for real isolation.

Written for: Claude Code 2.1.x (settings.json permissions, `Bash(cmd *)` rules)
Documentation it follows: Claude Code Docs: Configure permissions
Claude Code Docs: Settings files
Documentation checked: 2026-10-16

Your permission files

.claude/settings.json

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "permissions": {
    "allow": [
      "Bash(git status *)",
      "Bash(git diff *)",
      "Bash(git log *)",
      "Bash(npm test *)",
      "Bash(npm run test *)",
      "Bash(npm run lint *)",
      "Edit(/**)"
    ],
    "ask": [
      "Bash(git push *)",
      "Bash(npm install *)",
      "Bash(npm i *)"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(rm -fr *)",
      "Bash(rm -Rf *)",
      "Bash(rm -fR *)",
      "Bash(git push --force *)",
      "Bash(git push -f *)",
      "Bash(git reset --hard *)",
      "Bash(git clean *)",
      "Bash(docker system prune *)",
      "Bash(docker volume prune *)",
      "Bash(sh)",
      "Bash(bash)",
      "Bash(zsh)",
      "Bash(sudo *)",
      "Read(.env)",
      "Edit(.env)",
      "Read(.env.*)",
      "Edit(.env.*)",
      "Read(**/*.pem)",
      "Edit(**/*.pem)",
      "Read(~/.ssh/**)",
      "Edit(~/.ssh/**)",
      "Read(~/.aws/**)",
      "Edit(~/.aws/**)"
    ],
    "defaultMode": "default"
  }
}

Save it as .claude/settings.json in the project (shared with the team) or merge it into the file you have. Deny rules from any settings file win over allow rules.

Check these

Error0

High0

Medium0

Low0

Info0

No findings.

What it does

Coding agents ask before they run a command or change a file, unless a permission file says otherwise. This generator writes that file for Claude Code, Codex CLI or Gemini CLI from one neutral policy: what the agent may do on its own, what it must ask about, and what it may never do.

Every preset denies the same destructive commands and secret files. The presets differ in what they allow, and the findings say where a combination is risky or where a tool's format cannot express a rule, instead of leaving it out silently.

How it works

The files are written in your browser by @anaroq/agents. The same choices always give the same bytes; nothing you type is sent, stored or put in the link.
Each renderer follows the tool's own documentation, named next to the output with the date it was last checked. Where the tool publishes a JSON Schema (Claude Code), the file points to it.
Rules are written in the order the tool evaluates them. Claude Code checks deny, then ask, then allow; Codex applies the most restrictive match; Gemini CLI applies the highest priority, so denials get the highest.

Denied in every preset

rm -rf, rm -fr: Recursive forced deletion.
git push --force, git push -f: Rewrites history on the remote.
git reset --hard, git clean: Discards uncommitted work and untracked files.
docker system prune, docker volume prune: Deletes images, containers and volumes with their data.
sh, bash, zsh reading from a pipe: The end of curl … | sh: running a downloaded script.
sudo: Anything as root.
.env, .env.*, *.pem, ~/.ssh, ~/.aws: Secret files, for reading and writing by the agent's file tools.

Example

The local development preset for Claude Code, written by the same engine at build time:

Written for: Claude Code 2.1.x (settings.json permissions, `Bash(cmd *)` rules)

.claude/settings.json

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "permissions": {
    "allow": [
      "Bash(git status *)",
      "Bash(git diff *)",
      "Bash(git log *)",
      "Bash(npm test *)",
      "Bash(npm run test *)",
      "Bash(npm run lint *)",
      "Edit(/**)"
    ],
    "ask": [
      "Bash(git push *)",
      "Bash(npm install *)",
      "Bash(npm i *)"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(rm -fr *)",
      "Bash(rm -Rf *)",
      "Bash(rm -fR *)",
      "Bash(git push --force *)",
      "Bash(git push -f *)",
      "Bash(git reset --hard *)",
      "Bash(git clean *)",
      "Bash(docker system prune *)",
      "Bash(docker volume prune *)",
      "Bash(sh)",
      "Bash(bash)",
      "Bash(zsh)",
      "Bash(sudo *)",
      "Read(.env)",
      "Edit(.env)",
      "Read(.env.*)",
      "Edit(.env.*)",
      "Read(**/*.pem)",
      "Edit(**/*.pem)",
      "Read(~/.ssh/**)",
      "Edit(~/.ssh/**)",
      "Read(~/.aws/**)",
      "Edit(~/.aws/**)"
    ],
    "defaultMode": "default"
  }
}

Limits

This is not a complete security layer: it limits what the agent does on its own, not what a command, a dependency or a person can do. Use a sandbox or a separate machine for real isolation.

A permission file is not a sandbox. It limits what the agent does by itself, not what a command it is allowed to run does: an allowed npm test runs whatever the test script contains.
Command rules match the start of a command. A flag later in the command (git push origin main --force) or the same program by another path or inside sh -c is not matched, which is why the presets ask before or deny git push itself.
File rules cover the agent's file tools. A shell command such as cat .env is a shell command; keep secrets out of the project or use the tool's sandbox.
Codex CLI has no file path rules and runs an allowed rule outside its sandbox, so its files rely on the sandbox; the findings list what is left out.
Formats change. Each output names the tool version and documentation it was written for; check them against the version you run.

Agent Handoff Packet

Methodology: how the numbers are worked out

Sources

Updated 16 October 2026

Next step