You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
PermissionsArea: what it touches
Internal ChangesKind: in v2.1.307,
ImprovementsSection of the release
What
Claude Code checks every tool use, such as writing a file, against permission rules. A deny rule is a rule that blocks an action. The record of each permission decision now holds more detail:
When a deny rule blocks the Write tool, the failure now includes a denyRule field naming the rule. Before, it only marked that a permission rule had denied it (deniedByPermissionRule).
Deny rule hits found while checking edits (denyRule) are now recorded as permission decisions.
The decision record, which held only the decision, its source and a reason type, now also carries ruleSource, grantScope, reasonCode, circuitBreaker and classifierCategory.
The tool_decision event that Claude Code can export for monitoring adds grantScope for approvals that were not "always".
The Write tool's own description, as captured under this release, is unchanged.
Why
A denial can now name the exact rule behind it. Administrators who collect permission events can see where a rule came from and how widely an approval applied.
