Rule Precedence & Evaluation Logic

When multiple rules match a single tool call, Claude uses a strict precedence order to decide what to do.

Precedence Order

1. Deny (Highest)
2. Ask
3. Allow (Lowest)

The "Deny Wins" Rule: If any deny rule matches, the action is blocked, even if 10 other allow rules match it. This is why using deny for "absolute lines" is the safest practice.

Evaluation Logic

flowchart TD
  A[Tool call] --> B{Deny match?}
  B -- Yes --> Z[Block]
  B -- No --> C{Ask match?}
  C -- Yes --> P[Prompt]
  C -- No --> D{Allow match?}
  D -- Yes --> X[Execute]
  D -- No --> M[Fall back to Mode baseline]

dontAsk Exception

In dontAsk mode, any ask rule is treated as a deny. This prevents the agent from hanging in a headless environment.