Permission fatigue in Claude Code is a real security risk: when the AI asks for approval 40+ times a day, developers stop reading the prompts and approve reflexively, letting dangerous commands slip through. The solution is a three-layer configuration approach. Layer 1 uses an allowlist in settings.json to auto-approve routine read-only commands, so remaining prompts carry real signal. Layer 2 adds deny rules for hard 'nevers' like .env files, private keys, and force-pushes — these rules override everything and apply even when prompts are disabled. Layer 3 adds a PreToolUse bash hook for logic that glob patterns can't express, such as blocking rm -rf or distinguishing git push --force from --force-with-lease. With these backstops in place, switching to Claude Code's auto mode becomes a calculated decision rather than a reckless one, since deny rules and hooks fire before any permission-mode check and can't be bypassed by toggling settings.
