https://blogs.zethian.com/when-deny-doesnt-win.html Permission models, least privilege, and security boundaries for coding agents. en Sun, 09 Aug 2026 00:00:00 +0000 https://blogs.zethian.com/when-deny-doesnt-win.html https://blogs.zethian.com/when-deny-doesnt-win.html Thu, 30 Jul 2026 00:00:00 +0000 Claude Code resolves permission conflicts with a fixed deny-always-wins rule, so a read-only cloud policy cannot be expressed. permcheck runs as a PreToolUse hook and lets an exception carve through a broad deny when its match-set is a strict subset, with the enterprise cost of the single-shape policy and where auto mode fits.