Lesson 1.4: Settings and Configuration

🎯 What You'll Learn: How to configure Claude Code for productivity AND safety
⏱️ Time Required: 50 minutes
📦 What You'll Build: A customized settings.json with proper permissions

Riley's Journey Continues

Riley knows the commands. But every time Claude reads a file - click. Every search - click. She's still playing whack-a-mole with permissions.

💬 "I understood WHY the permissions existed - safety first. But I needed to find the balance between 'too cautious' and 'too risky.' That's what this lesson gave me."
— Riley Harper

This lesson teaches Riley (and you):

What We're Building in This Lesson

Configure once, benefit forever. The right settings make Claude feel like it was built just for you.

In this lesson:

The .claude Folder Structure

📁 .claude/
├── 📄 settings.json     ← Your configuration (this lesson)
├── 📄 CLAUDE.md         ← Project context (Week 2)
├── 📁 skills/           ← Your skills (you know this!)
│   └── 📁 your-skill/
│       └── 📄 SKILL.md
├── 📁 agents/           ← Custom agents (Week 2)
└── 📁 commands/         ← Custom commands

Today's focus: settings.json - your control panel.

Settings.json: Your Control Panel

settings.json controls what Claude can do, through one permissions section with two lists:

Anything not on either list, Claude asks you about before running.

The transformation:

BEFORE: Every action → Permission prompt → Click → Wait
AFTER:  Safe actions → Auto-approved → Smooth flow
        Risky actions → Permission prompt → You decide
        Dangerous actions → Blocked entirely → Protected

Permission Levels Explained

The allow list handles what runs without asking. The deny list is your hard stop, these never run regardless. Anything not in either list prompts for approval.

Riley's choice:

💬 "I went Balanced. Reads fly through automatically. Writes prompt me once. And anything destructive is blocked before Claude can even try."

Exercise: Configure Your Environment

⏱️ Total Time: 40 minutes

What You'll Build

⚙️ A properly configured settings.json with permissions, auto-approvals, and safety blocks.

Before You Start

You'll need:

Step 1: Find or Create settings.json

⏱️ Time: 5 minutes

Check if it exists:

cat ~/.claude/settings.json

If it doesn't exist, create it:

touch ~/.claude/settings.json

Open it in your editor.

✅ Success Check:

Step 2: Add Base Configuration

⏱️ Time: 10 minutes

Copy this Balanced template:

{
  "permissions": {
    "allow": [
      "Read",
      "Glob",
      "Grep",
      "Write",
      "Bash(git *)",
      "Bash(ls *)",
      "Bash(pwd)",
      "Bash(cat *)"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(sudo *)",
      "Bash(chmod 777 *)"
    ]
  }
}

How it works:

Claude will ask for approval on anything not explicitly listed. The * wildcard matches any arguments, Bash(git *) allows all git commands, Bash(rm -rf *) blocks that specific pattern.

Riley's configuration:

{
  "permissions": {
    "allow": [
      "Read",
      "Glob",
      "Grep",
      "Write",
      "Bash(git *)",
      "Bash(npm install)",
      "Bash(npm run *)",
      "Bash(ls *)",
      "Bash(pwd)"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(sudo *)",
      "Bash(chmod 777 *)",
      "Bash(git push --force*)"
    ]
  }
}

💬 "I added 'git push --force' to deny because that's caused problems before. Think about YOUR danger zones, whatever you'd regret if it ran without asking."

✅ Success Check:

Step 3: Customise Your Deny List

⏱️ Time: 10 minutes

Think about YOUR work. What should NEVER happen?

Universal Denies (Everyone Should Have)

"deny": [
  "Bash(rm -rf *)",
  "Bash(sudo *)",
  "Bash(chmod 777 *)",
  "Bash(dd *)",
  "Bash(mkfs *)"
]

Database Work? Add These:

"Bash(* DROP TABLE*)",
"Bash(* DROP DATABASE*)",
"Bash(* TRUNCATE *)",
"Bash(* DELETE FROM*)"

Cloud/Production? Add These:

"Bash(aws s3 rm *)",
"Bash(kubectl delete *)",
"Bash(* --production *)"

Git Safety? Add These:

"Bash(git push --force*)",
"Bash(git reset --hard *)",
"Bash(git clean -fd*)"

Fill in your deny patterns based on YOUR risk profile:

"permissions": {
  "allow": [
    "Read", "Glob", "Grep", "Write"
    // Add your safe Bash patterns here
  ],
  "deny": [
    // Universal
    "Bash(rm -rf *)",
    "Bash(sudo *)",
    "Bash(chmod 777 *)",

    // My specific blocks
    "_____________________",
    "_____________________"
  ]
}

✅ Success Check:

Step 4: Test Your Configuration

⏱️ Time: 15 minutes

Save your settings.json and test:

Test 1: Allowed Reads

Read my Quick Win skill file

Expected: Proceeds WITHOUT prompting (Read is in your allow list) ✅

Test 2: Writes (allowed but prompts by default)

Add a comment to my skill file

Expected: Either proceeds automatically (Write in allow list) or asks once ✅

Test 3: Denied Command

Run rm -rf on the temp folder

Expected: Claude refuses, the deny list catches it ✅

Test 4: Bash (pattern-matched)

Show me the current directory

Expected: Runs automatically if Bash(ls *) is in your allow list; prompts otherwise ✅

Riley's test results:

💬 "First test - reads flew through without prompting. That alone made my day better. Tested the deny, Claude refused cleanly. Everything working as designed."

✅ Success Check:

Optional: IDE Integration

⏱️ Time: 5 minutes (if you use VS Code)

If you use VS Code:

Key shortcuts:

💡 Pro Tip: Use terminal for complex tasks, IDE for quick questions about specific code.

Overall Success Criteria

By the end of this lesson, you should have:

Quick Verification:

Troubleshooting

// ❌ Wrong (trailing comma)
["read", "glob",]

// ✅ Right
["read", "glob"]

"deny": [
  "Bash(rm -rf *)",
  "Bash(rm -r -f *)",
  "Bash(rm -fr *)"
]

You Did It!

You just configured Claude Code to work YOUR way!

Riley's transformation:

💬 "This is when Claude Code stopped feeling like a tool I was fighting with and started feeling like a tool that understood me. The configuration took 30 minutes and saves me frustration every single day."

How Others Configure

James Chen, Healthcare IT Director

{
  "permissions": {
    "allow": [
      "Read", "Glob", "Grep", "Write",
      "Bash(git *)", "Bash(ls *)"
    ],
    "deny": [
      "Bash(rm -rf *)", "Bash(sudo *)",
      "Bash(curl *)", "Bash(wget *)"
    ]
  }
}

"In healthcare, data doesn't leave the system. I deny all network commands that could transmit data externally."

Dr. Sarah Patel, Management Consultant

{
  "permissions": {
    "allow": [
      "Read", "Glob", "Grep", "Write",
      "Bash(git *)", "Bash(ls *)"
    ],
    "deny": [
      "Bash(rm -rf *)", "Bash(sudo *)",
      "Bash(cd ../*)","Bash(* ../)"
    ]
  }
}

"I use project-specific settings for each client engagement. The deny list blocks any attempt to navigate out of the current directory. No cross-contamination."