TEXT

Update Agent Permissions

Contributed by grantcarthew

Improved by Laravel Company · 2026-09-07

Task: Securely Restrict Agent Permissions to Read-Only Operations

This task requires a comprehensive review of our conversation history and the implementation of granular security enhancements across multiple configuration files. Please follow the detailed instructions below to ensure the integrity and safety of our data and workflows.

Objective

Your goal is to identify all specific commands used throughout our conversation and analyze them against the current access permissions. The outcome should be a meticulous update of configuration files to restrict access to only read-only operations while maintaining necessary functionality.

Scope of Analysis

Included Files

  • Claude configuration: ~/.claude/settings.json
  • Gemini policy engine: ~/.gemini/policies/tool-permissions.toml
  • Gemini settings: ~/.gemini/settings.json
  • Gemini trusted folders: ~/.gemini/trustedFolders.json

Excluded Operations

Explicitly exclude any commands capable of modifying, deleting, or destroying data. This includes operations like git branch -D, git pull, git checkout, and any commands with destructive flags such as find -delete or find -exec.

Instructions

Step 1: Command Identification and Audit

  • Analyze the entire conversation history to identify all unique commands used, including subcommands and flags.
  • Compare these identified commands against the current allowed commands listed in the configuration files for both Claude and Gemini.

Step 2: Command Filtering

  • From the identified commands, filter out any that provide write, delete, or modify access to resources.
  • Focus exclusively on commands that allow only read-only access, such as get, describe, view, or similar operations.

Step 3: Granular Security Enhancements

  • For each filtered command, ensure it is listed individually in the configuration files. Do not use wildcards or catch-all rules.
  • Exclude any commands that, despite being read-only, could potentially disrupt ongoing work flows (e.g., git checkout).

Step 4: Configuration Updates

Claude Settings Update (JSON Format)

  • ~/.claude/settings.json
  • Add new read-only commands to the allow array in alphabetical order.
  • The format for each command is: Bash(command subcommand:*)

Example addition:

json
"allow": [
  "Bash(get:*)",
  "Bash(description:*)",
  "Bash(view:*)"
]

Gemini Policy Engine Update (TOML Format)

  • ~/.gemini/policies/tool-permissions.toml
  • Add new read-only commands to the appropriate existing [[rule]] block by category or create a new block if necessary.
  • Use commandPrefix for word-boundary matching in allow rules.
  • Ensure the decision is set to allow and the priority is set to 100 for read-only operations.

Example addition:

toml
[[rule]]
toolName = "get_command"
commandPrefix = ["get:", "describe:", "view:"]
decision = "allow"
priority = 100

Step 5: Directory Trust Management

  • If any new directories outside the workspace were accessed during the conversation, add them to both context.includeDirectories in ~/.gemini/settings.json and ~/.gemini/trustedFolders.json with a value of "TRUST_FOLDER".

Output Requirements

Categorized Command List

  • Present the list of identified commands under two categories: Read-Only and Write.
  • Within the Read-Only category, further categorize commands based on their functions, such as Read, Get, Describe, View, or similar.

Configuration File Updates

  • After my approval of the list, update both ~/.claude/settings.json and ~/.gemini/policies/tool-permissions.toml with the new read-only commands.
  • Ensure the updates maintain the exact formatting and syntax requirements specified for each tool.

Constraints and Limitations

  • The updates must not introduce any new vulnerabilities or security risks.
  • The updated configuration must not impede the functional workflows required for our tasks.
  • The updates must maintain the existing permissions for necessary write operations, ensuring that our tools remain operational.

Please provide a detailed report of the identified commands, the categorized list of read-only operations, and the specific updates made to both configuration files. Once approved, proceed with the actual updates.

Original prompt (before our improvements)

# Task: Update Agent Permissions Please analyse our entire conversation and identify all specific commands used. Update permissions for both Claude Code and Gemini CLI. ## Reference Files - Claude: ~/.claude/settings.json - Gemini policy: ~/.gemini/policies/tool-permissions.toml - Gemini settings: ~/.gemini/settings.json - Gemini trusted folders: ~/.gemini/trustedFolders.json ## Instructions 1. Audit: Compare the identified commands against the current allowed commands in both config files. 2. Filter: Only include commands that provide read-only access to resources. 3. Restrict: Explicitly exclude any commands capable of modifying, deleting, or destroying data. 4. Update: Add only the missing read-only commands to both config files. 5. Constraint: Do not use wildcards. Each command must be listed individually for granular security. Show me the list of commands under two categories: Read-Only, and Write We are mostly interested in the read-only commands here that fall under the categories: Read, Get, Describe, View, or similar. Once I have approved the list, update both config files. ## Claude Format File: ~/.claude/settings.json Claude uses a JSON permissions object with allow, deny, and ask arrays. Allow format: `Bash(command subcommand:*)` Insert new commands in alphabetical order within the allow array. ## Gemini Format File: ~/.gemini/policies/tool-permissions.toml Gemini uses a TOML policy engine with rules at different priority levels. Rule types and priorities: - `decision = "deny"` at `priority = 200` for destructive operations - `decision = "ask_user"` at `priority = 150` for write operations needing confirmation - `decision = "allow"` at `priority = 100` for read-only operations For allow rules, use `commandPrefix` (provides word-boundary matching). For deny and ask rules, use `commandRegex` (catches flag variants). New read-only commands should be added to the appropriate existing `[[rule]]` block by category, or a new block if no category fits. Example allow rule: ```toml [[rule]] toolName = "run_shell_command" commandPrefix = ["command subcommand1", "command subcommand2"] decision = "allow" priority = 100 ``` ## Gemini Directories If any new directories outside the workspace were accessed, add them to: - `context.includeDirectories` in ~/.gemini/settings.json - ~/.gemini/trustedFolders.json with value `"TRUST_FOLDER"` ## Exceptions Do not suggest adding the following commands: - git branch: The -D flag will delete branches - git pull: Incase a merge is actioned - git checkout: Changing branches can interrupt work - ajira issue create: To prevent excessive creation of new issues - find: The -delete and -exec flags are destructive (use fd instead)