Claude Code permissions: how allow, ask, and deny actually compose

Every Claude Code user builds a permission policy, most without noticing. Each time you answer a prompt with "yes, don't ask again", the rule lands in .claude/settings.local.json at the repo root and applies to every future session there. After a month you are running under an accumulated policy nobody ever read. This guide is about writing one on...