Claude Code's permission mechanism consists of three mutually independent yet combinable parts: the mode determines how actions are approved, rules specify which tool calls are allowed/asked about/denied, and the sandbox restricts the files and network that commands can actually access