Pre-approve or deny specific tools for a run
permissions & tools
// what it does
--allowedTools lists tools that execute without a prompt (--allowedTools "Bash,Read,Edit"), the usual way to let a headless run act without stalling. --disallowedTools denies specific tools, and --tools restricts which built-in tools are available at all. Entries use permission-rule syntax, so Bash(git diff *) pre-approves any command starting with git diff.
// shell
$ claude -p "run the tests and fix failures" --allowedTools "Bash,Read,Edit"$ claude --allowedTools "Bash(git diff *)" "Bash(git log *)" "Bash(git commit *)"// gotcha
The space before * matters: Bash(git diff *) matches git diff commands, but Bash(git diff*) would also match git diff-index. Deny rules always win over allow rules when both match a command.