Permission Modes and the Settings Hierarchy for the CCDV-F Exam

Permission mode is a risk decision, not a speed one

Claude Code lets you choose how much it pauses to ask before it acts, and the Claude Certified Developer - Foundations (CCDV-F) exam wants you to treat that choice as a risk decision rather than a way to go faster. A permission mode controls how often the agent stops to confirm an action, on a spectrum from prompting before everything to prompting for nothing. Picking a looser mode to reduce friction is exactly the framing that gets punished in a scenario, because the prompts you are removing are the human review gate that catches a broad or destructive action before it happens. This knowledge point builds directly on the Claude Code core components; here the concern is the safety envelope around them.

Four modes carry most of the weight. default prompts before edits and commands, so a human confirms each consequential action. acceptEdits auto-approves file edits and common filesystem commands such as mkdir, mv, and rm, but only for paths inside the working directory, and it still gates writes to protected paths, writes outside that directory, and other shell commands, trading some friction for speed on low-risk work. plan holds the agent read-only during the explore phase, so it can investigate and propose without changing anything. bypassPermissions silences every prompt and also drops the protected-path guard, which makes it powerful and dangerous: nothing stops an action, so it belongs only in an isolated environment where the worst case is contained. The mode you choose should track the worst-case cost of an unchecked action, not how impatient you are with prompts.

Two further modes appear in more specialised settings. auto auto-approves actions but routes each one through a separate classifier first, which blocks anything that escalates beyond your request, targets unrecognised infrastructure, or looks driven by hostile content; production deploys, migrations, mass deletes, and force-pushes to main stay blocked by default. It reduces prompts without fully surrendering oversight, though it is a research preview rather than a safety guarantee, and its availability depends on your plan and admin settings. dontAsk runs the opposite way: it auto-approves only the tools you named in an allow rule plus read-only commands and auto-denies everything else with no confirmation queue, which makes it a fit for locked-down CI and scripts rather than a way to smooth interactive work. If you want fewer prompts on trusted local work, reach for a classifier-gated mode like auto before ever considering a full bypass.

Settings layer by scope

Permissions are not set in one place. They layer across four scopes, and knowing the order is what lets you put a control where it will hold. User settings (~/.claude/settings.json) apply to everything a single developer does. Project settings (.claude/settings.json) are committed to the repository and shared with the team. Local project settings (settings.local.json) are git-ignored, so they hold one developer's personal overrides for that project without affecting anyone else. And enterprise settings (managed-settings.json) are admin-set and non-overridable: an organisation administrator defines them, and no developer configuration can remove or weaken them.

The practical consequence is about durability. A guardrail is only as strong as the scope it lives in. Put a team-wide control in user or local settings and another developer's configuration can override it, because those scopes are personal. Put it in project scope and it is shared and committed, so it travels with the repository. Put it in enterprise scope and it becomes a control no developer can touch. Much of the always-on guidance for a project lives in the CLAUDE.md and settings.json configuration, but where an enforceable rule sits in this hierarchy is what decides whether it can be bypassed.

Deny beats allow, and enterprise deny is the most durable

The precedence rule is the sharpest thing to memorise: a deny rule always wins over an allow rule, regardless of permission mode. If one layer allows a command and another denies it, the deny takes effect. This is what makes a deny rule the correct instrument for a hard guardrail: you are not hoping the agent avoids an action, you are forbidding it. And because deny always wins, the most durable guardrail is a deny at enterprise scope in managed-settings.json. No developer can remove it, it is not weakened by a looser permission mode, and it holds even under bypassPermissions, which drops other guards but cannot override an enterprise deny.

This is where mode and scope combine. bypassPermissions removes the interactive prompts and the protected-path guard, but an enterprise deny rule is not a prompt, it is a hard block, so it survives. That is the reasoning a scenario rewards: when a control absolutely must hold no matter how a developer runs the tool, it goes in an enterprise deny, because that is the one layer that a permission mode cannot loosen and a developer cannot edit away. Where you place the human review gate follows the same logic - it belongs wherever the worst-case cost of an unchecked action is highest, at irreversible writes, sensitive paths, or code the team has marked sensitive.

CLAUDE.md is guidance, not a guardrail

The most common misconception on this knowledge point is treating written instructions as enforcement. A line in CLAUDE.md that says "never touch the migrations directory" is guidance the agent will usually follow, but it is not a deterministic control. Only a deny rule or a hook enforces a boundary reliably; a CLAUDE.md instruction can be missed, deprioritised, or overridden by other context, so it cannot be the thing standing between an agent and a destructive action. If a path must never be written, a deny rule blocks it and a hook can intercept the attempt, whereas prose only asks.

The distinction to carry into the exam is deterministic versus probabilistic. Deny rules and hooks are deterministic: they run every time and cannot be talked out of it. Natural-language guidance in CLAUDE.md is probabilistic: reliable in practice, but not a guarantee. When a scenario asks how to guarantee a boundary holds, the answer is always a deny rule or a hook at the right scope, never a stronger sentence in CLAUDE.md.

What the CCDV-F exam trips candidates on

Three traps recur. The first is switching to bypassPermissions to reduce prompt friction on a non-isolated machine. Removing the prompts also removes the one confirmation that would have caught a broad or destructive action, so the credited reading is that a looser mode is a risk decision that was made carelessly, not a harmless convenience. The second is assuming a CLAUDE.md instruction not to touch a path is enforcement; only a deny rule or a hook enforces it deterministically, and a scenario that relies on prose for a hard boundary has a gap.

The third is putting a team-wide guardrail in user or local settings, where another developer's config can override it, instead of project or enterprise scope. When a control must hold for everyone, it belongs in a shared, higher-precedence scope - project for a committed team rule, enterprise for one no developer can remove. Reason from three facts - mode is a risk decision, deny beats allow, and only deny rules and hooks enforce - and these questions become straightforward.

Common misreadings to avoid

How this shows up on the exam

Domain 3 questions on this knowledge point are applied and safety-oriented. A common shape describes friction being traded for speed by loosening the permission mode, followed by a bad action; the correct reading is that mode is a risk decision and the review gate was removed where it was needed. Another shape relies on CLAUDE.md prose for a hard boundary and asks why it failed; the answer is that only a deny rule or a hook enforces. A third asks where to place a guardrail so no developer can override it, and the answer is a deny at enterprise scope in managed-settings.json.

This knowledge point sits on top of the Claude Code core components and pairs with Claude Code features and run modes, since headless and automated runs are exactly where an unattended permission mode and a durable deny rule matter most. It also connects to the CLAUDE.md and settings.json configuration that anchors a project, with the crucial distinction that configuration can guide, but only deny rules and hooks enforce.