PRODUCTION SCENARIO
Your team's shared settings deny Bash(aws *) to stop anyone changing infrastructure from a session. A developer adds Bash(aws s3 ls *) to their local allow list so they can pull bucket inventories, and Claude Code still blocks every aws s3 ls command.
Why is the command blocked, and what fixes it?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Deny is evaluated before allow, so the broad deny must be narrowed to the risky subcommands only
Permission rules are evaluated deny, then ask, then allow, and specificity does not change that order, so a broad deny like Bash(aws *) blocks calls that a narrower allow also matches. An allow rule cannot carve an exception out of a deny, which leaves narrowing the deny to the subcommands that should stay blocked.
Official Source: https://code.claude.com/docs/en/permissions ↗