{"version":"2.1.307","anchor":"write-tool-deny-results-now-carry-the-matching-deny-rule","canonical_anchor":"write-tool-deny-results-now-carry-the-matching-deny-rule","heading":"Permission decisions now record the deny rule, rule source and grant scope","tier":"notice","area":"Permissions","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.307\/e\/write-tool-deny-results-now-carry-the-matching-deny-rule","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.307","markdown":"### Permission decisions now record the deny rule, rule source and grant scope\n\nPermission decisions now carry which deny rule matched, where the rule came from, the grant scope, a reason code and more\n\n**What**\n\nClaude Code checks every tool use, such as writing a file, against permission rules. A deny rule is a rule that blocks an action. The record of each permission decision now holds more detail:\n\n- When a deny rule blocks the Write tool, the failure now includes a `denyRule` field naming the rule. Before, it only marked that a permission rule had denied it (`deniedByPermissionRule`).\n\n- Deny rule hits found while checking edits (`denyRule`) are now recorded as permission decisions.\n\n- The decision record, which held only the decision, its source and a reason type, now also carries `ruleSource`, `grantScope`, `reasonCode`, `circuitBreaker` and `classifierCategory`.\n\n- The `tool_decision` event that Claude Code can export for monitoring adds `grantScope` for approvals that were not \"always\".\n\nThe Write tool's own description, as captured under this release, is unchanged.\n\n**Why**\n\nA denial can now name the exact rule behind it. Administrators who collect permission events can see where a rule came from and how widely an approval applied.\n\n- Area: Permissions\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: no"}