Permission decisions now record the deny rule, rule source and grant scope

What

Claude Code checks every tool use, such as writing a file, against permission rules. A deny rule is a rule that blocks an action. The record of each permission decision now holds more detail:

• When a deny rule blocks the Write tool, the failure now includes a denyRule field naming the rule. Before, it only marked that a permission rule had denied it (deniedByPermissionRule).
• Deny rule hits found while checking edits (denyRule) are now recorded as permission decisions.
• The decision record, which held only the decision, its source and a reason type, now also carries ruleSource, grantScope, reasonCode, circuitBreaker and classifierCategory.
• The tool_decision event that Claude Code can export for monitoring adds grantScope for approvals that were not "always".

The Write tool's own description, as captured under this release, is unchanged.

Why

A denial can now name the exact rule behind it. Administrators who collect permission events can see where a rule came from and how widely an approval applied.