Claude Code · tool · fg-0490

Permission rules on Write(path), Glob(path), or a .claudeignore file are accepted but never enforced

Claude writes into a folder covered by a Write(docs/**) deny rule

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

File permission checks consult only Edit(path) and Read(path) rules. Path rules on Write, NotebookEdit, Glob, or MultiEdit load without error and are ignored, and a .claudeignore file has no effect; before v2.1.210 there was no warning.

Fix

Use Edit(path) for anything that writes and Read(path) for anything that reads or lists, and move .claudeignore entries into Read deny rules.

Apply

"permissions": { "deny": ["Edit(docs/**)", "Read(docs/private/**)"] }

Affects: Claude Code permission rules, as of 2026-10; startup warning since v2.1.210

Sources

https://code.claude.com/docs/en/permissions

Have your agent know this before it fails

claude mcp add --transport http footgun https://getfootgun.com/api/mcp