أمان كود كلود: الأذونات ووضع الحماية والاستخدام الآمن

Claude Code runs commands and edits files in your environment. That power requires guardrails. The permission system lets you define exactly what Claude Code can access, what it can modify, and what actions require your explicit approval.

لدى Claude Code ثلاثة أوضاع إذن تتحكم في مقدار الاستقلالية التي يحصل عليها الوكيل:

يتم تعيين الأذونات الدقيقة في settings.json. استخدم الأنماط الشاملة للتحكم في الملفات والأوامر التي يمكن لـ Claude Code الوصول إليها:

// .claude/settings.json
{
  "permissions": {
    "allow": [
      "Read:**",
      "Edit:src/**",
      "Edit:tests/**",
      "Bash:npm run *",
      "Bash:git *"
    ],
    "deny": [
      "Edit:.env*",
      "Edit:*.secret",
      "Edit:credentials/**",
      "Bash:rm -rf *",
      "Bash:curl * | bash",
      "Bash:git push --force*"
    ]
  }
}

Claude Code uses filesystem sandboxing to restrict where the agent can operate. By default, it can only access files within your project directory. You can further restrict this with allow/deny rules.

# Claude Code runs in a sandbox by default:
# ✅ Can read/write files in your project directory
# ❌ Cannot access files outside the project
# ❌ Cannot access system files
# ❌ Cannot access other users' home directories

# Add extra directories if needed:
claude --add-dir /path/to/shared/library