Documentation Type
Missing documentation (feature not documented)
Documentation Location
Section/Topic
- In
docs/en/settings, the "Permission settings" table. - In docs/en/iam, the "Tool-specific permission rules" section (specifically the Bash subsection).
Current Documentation
In settings.md (https://code.claude.com/docs/en/settings#permission-settings), the description for allow says:
"Array of permission rules to allow tool use. Note: Bash rules use prefix matching, not regex"
And the description for deny says:
"Note: Bash patterns are prefix matches and can be bypassed..."
However, in iam.md (https://code.claude.com/docs/en/iam#tool-specific-permission-rules), the documentation says:
"*Bash permission rules support both prefix matching with : and wildcard matching with ***: ... The * wildcard can appear at any position and matches any sequence of characters"
What's Wrong or Missing?
The documentation in settings.md contradicts iam.md. The settings documentation explicitly states that Bash rules rely on "prefix matching," implying that standard wildcards do not work or only work at the end of the string. The IAM documentation correctly reflects newer functionality where the * wildcard can appear at any position (e.g., Bash(* install)).
This contradiction makes it difficult for users to know if they can use patterns like Bash(*.py) or Bash(npm run *) inside their settings.json file.
Suggested Improvement
Update the "Permission settings" table in https://code.claude.com/docs/en/settings to reflect that Bash rules support full wildcard matching, not just prefix matching.
Suggested change for allow description in settings.md:
"Array of permission rules to allow tool use. Bash rules support wildcard (*) matching at any position."
Suggested change for deny description in settings.md:
"Array of permission rules to deny tool use. Use this to also exclude sensitive files from Claude Code access."
Impact
High - Prevents users from using a feature
Additional Context
Recent updates to Claude Code (around v2.1.0) introduced full wildcard pattern matching for Bash tool permissions. It appears the IAM documentation was updated to reflect this feature, but the specific table in the Settings documentation contains outdated legacy text describing the old prefix-only behavior.
Documentation Type
Missing documentation (feature not documented)
Documentation Location
Section/Topic
docs/en/settings, the "Permission settings" table. - Indocs/en/iam, the "Tool-specific permission rules" section (specifically the Bash subsection).Current Documentation
In settings.md (https://code.claude.com/docs/en/settings#permission-settings), the description for
allowsays:And the description for
denysays:However, in iam.md (https://code.claude.com/docs/en/iam#tool-specific-permission-rules), the documentation says:
What's Wrong or Missing?
The documentation in
settings.mdcontradictsiam.md. The settings documentation explicitly states that Bash rules rely on "prefix matching," implying that standard wildcards do not work or only work at the end of the string. The IAM documentation correctly reflects newer functionality where the*wildcard can appear at any position (e.g.,Bash(* install)).This contradiction makes it difficult for users to know if they can use patterns like
Bash(*.py)orBash(npm run *)inside theirsettings.jsonfile.Suggested Improvement
Update the "Permission settings" table in
https://code.claude.com/docs/en/settingsto reflect that Bash rules support full wildcard matching, not just prefix matching.Suggested change for
allowdescription in settings.md:Suggested change for
denydescription in settings.md:Impact
High - Prevents users from using a feature
Additional Context
Recent updates to Claude Code (around v2.1.0) introduced full wildcard pattern matching for Bash tool permissions. It appears the IAM documentation was updated to reflect this feature, but the specific table in the Settings documentation contains outdated legacy text describing the old prefix-only behavior.