Start here. One-call summary of the permission configuration in force for a directory: which settings files contribute, how many allow/ask/deny rules each carries, the winning defaultMode, blanket allows, hooks wired to tool use, and how many rules do not do what they look like they do. Use at session start, before an unattended run, or when a prompt appeared that you did not expect.

Every settings file that can contribute permission rules, in documented precedence order, with whether it exists, whether it parsed, how many rules it carries, and what a leading / in its path rules anchors to. Use when a rule is not taking effect, when you cannot tell which file granted something, or to confirm a managed policy is or is not present.

Permission rules whose documented behaviour differs from their apparent intent: rules Claude Code accepts and never consults, /path rules in user settings that anchor at the config directory rather than your project, wildcards without a word boundary, allow rules on commands that run other commands, and allow rules a deny or ask rule reaches first. Each finding cites the documented behaviour. Use before trusting a guard rail you wrote a while ago.

The parts of the configuration that let a tool call go through without a human: the winning defaultMode, blanket allow rules, extra directories granted, whether bypass and auto modes are disabled, and hook commands — which run on agent events without a permission prompt of their own. Use before leaving an agent running unattended, or when reviewing what a repo's settings would do on your machine.