Controlling Claude Code permission prompts in a .NET project
Auto mode in Claude Code still lets an AI classifier decide which actions are safe. The author shows how to add ask and deny rules to a .NET project's settings file to keep control over EF Core migrations, running the app and database updates. He also explains that a deny rule wins over allow and ask rules, whichever settings file holds it.
Key points
- Put ask and deny rules that the whole team should share in .claude/settings.json at the project root.
- Add dotnet ef migrations add and dotnet run to the ask list so each run needs your approval, even in auto mode.
- Deny Edit(**/Migrations/**) to stop hand-written migration files and Bash(dotnet ef database update *) to keep database updates manual.
- A deny rule wins over allow and ask in any settings file, including ~/.claude/settings.json in your home directory.
- When ask and allow both match, ask wins, so a local ask rule can still prompt you for a command you allowed.
- Run /permissions in Claude Code to list every rule in effect for the project.
Claude Code's auto mode now lets a second model, a classifier, review riskier shell commands and web requests before they run. The author found it misses actions that are not dangerous but still disruptive: a hand-written EF Core migration that broke the database update, and a website left running in the background during CSS work. His fix is a .claude/settings.json file with an ask list for dotnet ef migrations add and dotnet run, and a deny list that blocks edits in Migrations and dotnet ef database update.
The surprising part is precedence. A deny rule beats ask and allow rules whichever settings file holds it, so a leftover deny for dotnet run in the home directory's user settings blocked the app even after the project allowed it. Run /permissions in Claude Code to see every rule that applies before you rely on them.
Real-world use
- A shared EF Core project where migrations are created only through the dotnet ef CLI and database updates stay manual.
- An ASP.NET Core MVC site where Claude Code may edit views and CSS, but should not start the website in the background.
- A developer machine where old test permission rules left in the home directory settings.json silently block the app.
Why it matters
Auto mode judges risk with a general classifier, which may not match your project's rules. Explicit ask and deny lists in the repo keep migrations, database changes and running processes under your control, and knowing the precedence prevents rules from silently blocking your work.