--- title: "Permission Fatigue Is a Security Risk — Improve It in Claude Code" url: https://daily.dev/posts/permission-fatigue-is-a-security-risk-improve-it-in-claude-code-qhdplwhrs source_url: https://spin.atomicobject.com/permission-fatigue-claude-code type: article source: "Atomic Spin" published: 2026-07-07T12:05:21.056Z updated: 2026-07-07T12:05:45.049Z tags: ["security", "ai-coding", "claude-code", "prompt-injection"] reading_time: 12 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Permission Fatigue Is a Security Risk — Improve It in Claude Code **[Atomic Spin](https://daily.dev/sources/atomicobject)** · 12 min read · 0 upvotes · 0 comments ## Summary Permission fatigue in Claude Code is a real security risk: when the AI asks for approval 40+ times a day, developers stop reading the prompts and approve reflexively, letting dangerous commands slip through. The solution is a three-layer configuration approach. Layer 1 uses an allowlist in settings.json to auto-approve routine read-only commands, so remaining prompts carry real signal. Layer 2 adds deny rules for hard 'nevers' like .env files, private keys, and force-pushes — these rules override everything and apply even when prompts are disabled. Layer 3 adds a PreToolUse bash hook for logic that glob patterns can't express, such as blocking rm -rf or distinguishing git push --force from --force-with-lease. With these backstops in place, switching to Claude Code's auto mode becomes a calculated decision rather than a reckless one, since deny rules and hooks fire before any permission-mode check and can't be bypassed by toggling settings. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#ai-coding](https://daily.dev/tags/ai-coding), [#claude-code](https://daily.dev/tags/claude-code), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/permission-fatigue-is-a-security-risk-improve-it-in-claude-code-qhdplwhrs)