386 pages for permissions.

multiagent-orchestration Claude Developer Platform · in the page managed-agents/multiagent-orchestration …st, interrupt, or archive threads, read their events, and handle tool permissions across them, see [Session threads](https://platform.claude.com/docs/en/managed-agents/session-threads). ## Dynamic wo… permission-policies Claude Developer Platform · in the page managed-agents/permission-policies …with. Updates apply to sessions created afterward. ### Agent toolset permissions When creating an agent, you can apply a policy to every tool in `agent_toolset_20260401` using `default_config.permis… scheduled-deployments Claude Developer Platform · in the page managed-agents/scheduled-deployments …ipal to call `sts:AssumeRole` and `sts:SetSourceIdentity`. * **Role permissions:** Allow `aws-external-anthropic:CreateSession`, `sts:GetWebIdentityToken`, and `sts:TagGetWebIdentityToken`. * **Ca… secure-deployment Claude Developer Platform · in the page managed-agents/secure-deployment …| | The key's permissions, at the service that issued the key | Only the permissions the agent needs… secure-deployment-risks Claude Developer Platform · in the page managed-agents/secure-deployment-risks …t is allowed to read into its own reply or tool output. Limit a key's permissions at the service that issued it, because these settings do not limit them. The settings do not secure your custom tools,… spawn.sh: called once per claimed work item Claude Developer Platform · in the page managed-agents/self-hosted-sandboxes …ent may run directly. The CLI and SDK workers preserve the executable permissions recorded in the skill bundle when they extract it. If you implement skills download manually, you are responsible for… self-hosted-sandboxes-reference Claude Developer Platform · in the page managed-agents/self-hosted-sandboxes-reference …ent may run directly. The CLI and SDK workers preserve the executable permissions recorded in the skill bundle when they extract it. If you implement skills download manually, you are responsible for… self-hosted-sandboxes-security Claude Developer Platform · in the page managed-agents/self-hosted-sandboxes-security …keep it out of images and shared volumes, and never log it. * **Tool permissions.** Tools run inside your sandbox with whatever permissions your process has. Apply least privilege to the process user… session-threads Claude Developer Platform · in the page managed-agents/session-threads …e threads of a multiagent session, read their events, and handle tool permissions across them. featureMetadata: topic: title: Managed Agents url: https://platform.claude.com/docs/en/managed-… skills Claude Developer Platform · in the page managed-agents/skills …tHub](https://platform.claude.com/docs/en/managed-agents/github#token-permissions); `mount_path` (java, php: `mountPath`; csharp, go: `MountPath`) is optional and defaults to `/workspace/<repo-name>`:… vaults Claude Developer Platform · in the page managed-agents/vaults …in the vault instead. <Tip> Scope the API key to only the permissions the agent needs. The agent can do anything the key allows, so a key with broader permissions than necessary increases… overview Claude Developer Platform · in the page release-notes/overview …-claude/workload-identity-federation#service-accounts), with the same permissions, and stop working when the linked account is removed from an organization. This lets organization admins more easily t… mitigate-jailbreaks Claude Developer Platform · in the page test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks …crets it doesn't need, run tools in sandboxed environments, and scope permissions as narrowly as possible. * **Screen tool outputs before Claude acts on them.** Apply the same lightweight-model scree… Use Claude Code with a screen reader Claude Code CLI · in the page accessibility …r NVDA reads in order. You can hold a full conversation, approve tool permissions, and review output end to end. Screen reader mode is opt-in. If you use a screen magnifier, reduced motion, or a colo… Set up Claude Code for your organization Claude Code CLI · in the page admin-setup …-to-enforce) | Which tools, commands, and integrations are allowed | [Permissions](/docs/en/permissions.md), [Sandboxing](/docs/en/sandboxing.md) | | [Set up usage visibility](#set-up-usage-visibility… How the agent loop works Claude Code CLI · in the page agent-sdk/agent-loop …a standalone package that gives you programmatic control over tools, permissions, cost limits, and output. Both the TypeScript and Python SDKs bundle a native Claude Code binary, so most installs ne… Use Claude Code features in the SDK Claude Code CLI · in the page agent-sdk/claude-code-features …give the agent access to CLAUDE.md, skills, hooks, and # permissions from both locations. setting_sources=["user", "project"], allowed_tools=["Read", "Edit", "Bash… Configure your agent Claude Code CLI · in the page agent-sdk/configuration …. For more information, see [Allow and deny rules](/docs/en/agent-sdk/permissions.md#allow-and-deny-rules). ## Load settings files Settings files supply configuration beyond the options object. Two… Track cost and usage Claude Code CLI · in the page agent-sdk/cost-tracking …/docs/en/agent-sdk/overview.md) - Getting started with the SDK * [SDK Permissions](/docs/en/agent-sdk/permissions.md) - Managing tool permissions Give Claude custom tools Claude Code CLI · in the page agent-sdk/custom-tools …available; calls go through the [permission flow](/docs/en/agent-sdk/permissions.md). | | disallowed tools | Both | A bare tool name such as `"Bash"` removes the tool from Claude's context, the same… Rewind file changes with checkpointing Claude Code CLI · in the page agent-sdk/file-checkpointing …ompt. For more information, see [Permission modes](/docs/en/agent-sdk/permissions.md#permission-modes). **2. Capture checkpoint UUID and session ID** With the `replay-user-messages` option set, each… Intercept and control agent behavior with hooks Claude Code CLI · in the page agent-sdk/hooks …out user confirmation, apart from reads from [network paths](/docs/en/permissions.md#network-paths), while leaving all other tools subject to normal permission checks: ```python Python theme={null} a… Connect to external tools with MCP Claude Code CLI · in the page agent-sdk/mcp …` or `mcp__github__*`, in [`allowedTools`](#allow-mcp-tools) or in a `permissions.allow` rule in the `settings` option. An [`mcp_tool` hook](/docs/en/hooks#mcp-tool-hook-fields) also names the server… Modifying system prompts Claude Code CLI · in the page agent-sdk/modifying-system-prompts …s/en/agent-sdk/skills.md), [hooks](/docs/en/agent-sdk/hooks.md), and [permissions](/docs/en/agent-sdk/permissions.md) also shape behavior outside the system prompt and are covered on their own pages.… Agent SDK overview Claude Code CLI · in the page agent-sdk/overview …Claude Code's [capabilities](#capabilities), such as built-in tools, permissions, sessions, and hooks. | | Do interactive development or run one-off tasks from a terminal | [**Claude Code CLI**](/doc… Plugins in the SDK Claude Code CLI · in the page agent-sdk/plugins …includes a manifest, ensure it has valid JSON syntax 3. **Check file permissions**: ensure the plugin directory is readable 4. **Confirm the directory exists**: the SDK skips a nonexistent path, and… Agent SDK reference - Python Claude Code CLI · in the page agent-sdk/python …session in `auto` mode [changes to `default` mode](/docs/en/agent-sdk/permissions#auto-mode-auto) if the new model doesn't support auto mode | | `rewind_files(user_message_id)` | Restore files to thei… Quickstart Claude Code CLI · in the page agent-sdk/quickstart …er with your allow and deny rules in a fixed order, described in [How permissions are evaluated](/docs/en/agent-sdk/permissions.md#how-permissions-are-evaluated). For the full list of modes, their beh… Securely deploying AI agents Claude Code CLI · in the page agent-sdk/secure-deployment …[security documentation](/docs/en/security.md) for full details. * **Permissions system**: Every tool and bash command can be configured to allow, block, or prompt the user for approval. Use glob pat… Extend agents with skills Claude Code CLI · in the page agent-sdk/skills …flow, including permission modes and the `canUseTool` callback, see [Permissions](/docs/en/agent-sdk/permissions.md). ## Troubleshooting ### Skills not found **Check settingSources configuration**… Stream responses in real-time Claude Code CLI · in the page agent-sdk/streaming-output …dk/structured-outputs.md): get typed JSON responses from the agent * [Permissions](/docs/en/agent-sdk/permissions.md): control which tools the agent can use Subagents in the SDK Claude Code CLI · in the page agent-sdk/subagents …ithin this agent. The [subagent inheritance rules](/docs/en/agent-sdk/permissions.md#available-modes) decide when it applies | In the Python SDK, multi-word field names such as `disallowedTools` and… Track todos Claude Code CLI · in the page agent-sdk/todo-tracking …: * Name one of the tools in the [`allowedTools`](/docs/en/agent-sdk/permissions#allow-and-deny-rules) (TypeScript) or `allowed_tools` (Python) option * List the tools in the `tools` option, which re… Agent SDK reference - TypeScript Claude Code CLI · in the page agent-sdk/typescript …Settings` to include them. * **`defaultMode`**: the snapshot returns `permissions.defaultMode` as-is from every tier, so it can include the `'auto'` and `'bypassPermissions'` values from project and l… Handle approvals and user input Claude Code CLI · in the page agent-sdk/user-input …ol that isn't auto-approved by a [permission rule](/docs/en/agent-sdk/permissions.md) or permission mode. Check `tool_name` for the tool (e.g., `"Bash"`, `"Write"`). 2. **Claude asks a question**: Cla… Orchestrate teams of Claude Code sessions Claude Code CLI · in the page agent-teams …ts and commands still go through the permission prompts described in [Permissions](#permissions). Once approved, the teammate exits plan mode and begins implementation. If you put a running in-proces… Manage multiple agents with agent view Claude Code CLI · in the page agent-view …`` If you haven't yet accepted the [workspace trust dialog](/docs/en/permissions.md#project-allow-rules-and-workspace-trust) for the directory, Claude Code shows it before agent view opens, the same… Claude Code on Amazon Bedrock Claude Code CLI · in the page amazon-bedrock …n't have another mechanism for getting credentials) * Appropriate IAM permissions To sign in with your own Amazon Bedrock credentials, follow [Sign in with Amazon Bedrock](#sign-in-with-bedrock) belo… Track team usage with analytics Claude Code CLI · in the page analytics …ely](/docs/en/costs.md): set spend limits and optimize token usage * [Permissions](/docs/en/permissions.md): configure roles and permissions Share session output as artifacts Claude Code CLI · in the page artifacts …To let Claude read a file outside your [working directories](/docs/en/permissions.md#working-directories) without your approval, add its folder as a working directory with [`--add-dir`](/docs/en/cli-r… Authentication Claude Code CLI · in the page authentication …r teams. * **Claude for Enterprise**: adds domain capture, role-based permissions, and the compliance API. Best for larger organizations with security and compliance requirements. **1. Subscribe** S… Configure auto mode Claude Code CLI · in the page auto-mode-config …eckpoint](#add-a-human-checkpoint) for pushes and pull requests with `permissions.ask` * [Define trusted infrastructure](#define-trusted-infrastructure) with `autoMode.environment` * [Generate environ… Best practices for Claude Code Claude Code CLI · in the page best-practices …e prompt. * **Give URLs** for documentation and API references. Use `/permissions` to allowlist frequently used domains. * **Pipe in data** by running `cat error.log | claude -p "explain this error"`… Champion kit Claude Code CLI · in the page champion-kit …laude researches and proposes changes without editing your source. | [Permissions](/docs/en/permissions.md) | | "Is the setup worth the effort?" | Installation takes roughly two minutes, runs in the t… Claude Code changelog Claude Code CLI · in the page changelog …way being rejected when `OTEL_EXPORTER_OTLP_HEADERS` is set * Fixed `/permissions` > Recently denied not showing the denied shell command, and auto mode's local classifier ignoring an approval from th… Push events into a running session with channels Claude Code CLI · in the page channels …o **OAuth2 > URL Generator**. Select the `bot` scope and enable these permissions: * View Channels * Send Messages * Send Messages in Threads * Read Message History * Attach Files * Add Reactions Op… Use Claude Code with Chrome Claude Code CLI · in the page chrome …one-time dialog that introduces the integration and explains how site permissions work. Press Enter to continue. To enable Chrome for future sessions without the flag, see [Enable Chrome by default](… Claude apps gateway for Amazon Bedrock, Claude Platform on AWS, Google Cloud, and Microsoft Foundry Claude Code CLI · in the page claude-apps-gateway …ettings-precedence). Different teams get different models, tools, and permissions, and a developer can't override what their policy locks. * **Settings delivery**: the gateway delivers managed setting… Claude apps gateway configuration Claude Code CLI · in the page claude-apps-gateway-config …ial `auth:` block passed validation. | Setup | How | | - | - | | IAM permissions | Grant the gateway's principal `bedrock:InvokeModel` and `bedrock:InvokeModelWithResponseStream` on both the inferenc… Deploy Claude apps gateway on AWS Claude Code CLI · in the page claude-apps-gateway-on-aws …of Bedrock or alongside it. Its upstream entry, credentials, and IAM permissions differ from this page's Bedrock-scoped ones; the [Claude Platform on AWS upstream reference](/docs/en/claude-apps-gate…