What
Permission rules now support matching on a specific tool input parameter value, allowing fine-grained auto-handling without a blanket allow.
Details
- Example rules:
deny Agent(model:opus)orask Bash(run_in_background:true). - Tip: "Deny and ask rules can match a tool input parameter — e.g., deny Agent(model:opus) or ask Bash(run_in_background:true) — so that specific pattern is auto-handled without prompting each time."
- The
/permissionspanel guidance also updated to reference this syntax.
Evidence
New permissions tip (search for "Deny and ask rules can match a tool input parameter", "/permissions, then add a Tool(param:value) deny or ask rule")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.