Check What a Permission Rule Actually Allows
A permission rule is easiest to assess with two small examples: one operation you intend to allow and one nearby operation you intend to deny.
For a document-cleanup task, use a disposable workspace. Check whether Claude Code can read the sample files and write the cleaned copies there. Then check the boundary you care about, such as writing outside that directory. Inspect the effective permission configuration instead of relying on the wording of your prompt.
Keep the experiment harmless and use the installed version's permission documentation. A successful allowed operation says nothing about the denied case. If the rule needs broad access just to perform a narrow job, revisit the workflow before making that broad access a permanent convenience.
