{"version":"2.1.269","anchor":"deniedask-permission-rules-starting-with-a-negated-readedi","canonical_anchor":"deniedask-permission-rules-starting-with-a-negated-readedi","heading":"Denied\/ask permission rules starting with a negated Read\/Edit pattern are now dropped with a warning","tier":"notice","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.269\/e\/deniedask-permission-rules-starting-with-a-negated-readedi","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.269","markdown":"### Denied\/ask permission rules starting with a negated Read\/Edit pattern are now dropped with a warning\n\nDeny\/ask permission rules that start with a negated Read\/Edit pattern are now dropped with a warning\n\n**What**\n\nWhen Claude Code merges deny or ask permission rules from managed settings, or combines always-deny command rules, it now filters out any rule that starts with a negated `Read(!...)` or `Edit(!...)` pattern. A warning is logged telling the administrator to write the deny rule without the exception.\n\nThis is because a rule starting with `!` removes paths from the rules listed before it rather than adding a new restriction, so putting it first in a deny or ask list wouldn't restrict anything as the administrator likely intended.\n\n**Why**\n\nThis stops a misconfigured permission rule from silently doing nothing (or the opposite of what was intended), and instead surfaces a warning so the administrator can fix the rule.\n\n- Area: Permissions\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}