Unverified50% confidenceDecision RuleExact time
In the Claude Agent SDK permission system, the allowed list only means pre-approval; tools not listed are not turned off but instead go to permission-mode handling; to remove a tool you must put its bare name in the disallowed list.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/27/2026
First Seen
Valid until: 1/25/2027
Sources
Claude Agent SDK in Practice: Building Your First AI Agent Step by Step
youtubeARE AGI10/27/2026
Related Entities
Related Claims
UnverifiedCommon values of the Claude Agent SDK permission mode include default (calls not pre-approved require callback confirmation, and no callback means denial), acceptEdits (automatically accept file edits), dontAsk (deny if not pre-approved), and bypassPermissions (skip all permission checks).77% similarUnverifiedTo completely prohibit a dangerous tool, it should be removed from the tools configuration rather than restricted using allowedTools.65% similarUnverifiedIt is recommended to disable the auto-execution feature of AI Agents and to require additional authorization via whitelists/blacklists for high-risk commands such as rm, dd, and mkfs.64% similarUnverifiedDeny by default is a basic principle of secure design: anything not explicitly allowed is forbidden, because a deny list is never complete and an attacker only needs to find a path that is not listed.64% similarUnverifiedWhen Claude requests to use a tool, the permission options include: allow only once, always allow for this session, and deny.62% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1103795API
curl https://kongchang.com/api/v1/knowledge/claims/1103795MCP
get_claim(id=1103795)