Verified against code.claude.com/docs/en/permission-modes and fixed 6 points:
1. acceptEdits: add PowerShell tool auto-approvals (Set-Content/Add-Content/
Clear-Content/Remove-Item + aliases) and env-prefix/process-wrapper note.
2. Protected paths: .claude exception is ONLY .claude/worktrees (was wrongly
widened to commands/agents/skills); add per-mode protected-write table.
3. defaultMode:"auto" ignored from project files since v2.1.142+.
4. dontAsk: read-only Bash commands also run without allow rules; explicit ask
rules are denied (not prompted).
5. auto conversational boundary: stays in force until user lifts it; Claude's own
judgment doesn't lift it; lost on context compaction; use deny rule for hard.
6. auto consecutive-failure fallback: 3-in-a-row / 20-total pauses & re-prompts;
-p non-interactive aborts the session. Plus dropped broad allow-rules on entry.
Co-authored-by: chenchen <chenchen@xinghanlab.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Adds a reading guide, the full 6 permission modes (incl. dontAsk) + auto-mode
admin enablement toggle, confirmed role facts (UsageView roles; full matrix is
external; iam pages 404), deep permission-rule syntax (Bash spacing, Read/Edit
anchors, MCP/Agent), real MCP credential mechanisms (headersHelper/${VAR}/OAuth),
expanded usage/cost/attribution/analytics, plus two big appendices: verbatim
config examples (A1–A10) and step-by-step end-to-end flows (managed-settings
lifecycle, MCP allow/deny worked example, auto-mode force-push decision, auth
credential selection). Sourced from re-fetching the 6 core docs + permission-
modes/permissions/mcp/costs/monitoring-usage/analytics.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Expands §1.2 into a proper three-tier section: positioning per tier, a
capability × tier table (with source + whether the doc is explicit), the
billing differences, and the documented contradiction (authentication lists
"managed policy settings" as Enterprise-only while the server-managed-settings
feature page says Teams+ can use it). Also flags that most controls hinge on
provider (Anthropic-direct + admin write access) rather than subscription tier.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Standalone reading reference faithfully consolidating the six official Claude
docs (admin-setup, authentication, server-managed-settings, settings,
managed-mcp, auto-mode-config): auth methods + precedence, roles/seats/admin,
settings scope precedence & merge rules, server-managed-settings mechanism,
full managed-only/permissions/model/sandbox/MCP key reference, managed-mcp
seven modes + allow/deny evaluation, auto-mode classifier, usage/audit, and
quick-reference tables. No HM design — pure Claude reference for study.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
