{"version":"2.1.321","anchor":"launch-denyask-rules-starting-with-are-ignored-with-a-war","canonical_anchor":"launch-denyask-rules-starting-with-are-ignored-with-a-war","heading":"Launch permission rules starting with ! are now ignored with a warning","tier":"notice","area":"Permissions","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.321\/e\/launch-denyask-rules-starting-with-are-ignored-with-a-war","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.321","markdown":"### Launch permission rules starting with ! are now ignored with a warning\n\nDeny or ask rules beginning with ! in `CLAUDE_CODE_MCP_SERVE_SETTINGS` are dropped with a warning, since they would loosen earlier rules\n\n**Unclear.** It is not clear whether launch-time rules from sources other than `CLAUDE_CODE_MCP_SERVE_SETTINGS` are covered too.\n\n**What**\n\nPermission rules decide what Claude Code may do without asking. A deny rule blocks an action and an ask rule makes Claude Code ask first. Deny or ask rules supplied at launch through `CLAUDE_CODE_MCP_SERVE_SETTINGS` that begin with `!` are now dropped, and Claude Code shows a warning.\n\nA rule starting with `!` removes paths from the rules listed before it instead of restricting anything. That would include the rules of the session that launched Claude Code.\n\n**Why**\n\nThis closes a way for launch settings to quietly widen access, by undoing restrictions the calling session had set.\n\n- Area: Permissions\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: yes"}