The Permission Rules You Added for Safety Are Taxing Every Turn — Auditing the Ruleset Without Loosening It

Find the rules that are already covered

Duplicates are easy. Shadowing is where the volume actually comes from: you deny Bash(rm -rf:*), and somewhere else you also deny Bash(rm -rf /tmp/cache:*). The second one is swallowed by the first. It exists only to be matched against.

Deciding glob containment rigorously is hard, so I settled for a practical approximation: within one bucket and one tool, check whether one pattern's literal prefix contains another's.

#!/usr/bin/env python3
"""find_shadowed.py — detect rules covered by a broader rule in the same bucket.
 
Usage:
    python3 find_shadowed.py ~/.claude/settings.json
"""
import json
import re
import sys
from collections import defaultdict
from pathlib import Path
 
RULE_RE = re.compile(r"^(?P<tool>[A-Za-z_][\w-]*)(?:\((?P<arg>.*)\))?$")
 
 
def literal_prefix(pattern: str) -> str:
    """Return the literal part before any glob. 'rm -rf:*' -> 'rm -rf:'"""
    out = []
    for ch in pattern:
        if ch in "*?[":
            break
        out.append(ch)
    return "".join(out)
 
 
def covers(broad: str, narrow: str) -> bool:
    """True if broad plausibly swallows narrow. Deliberately conservative."""
    if broad == narrow:
        return False
    if not broad.endswith("*"):
        return False  # no trailing wildcard: do not attempt a verdict
    bp = literal_prefix(broad)
    np = literal_prefix(narrow)
    if not bp:
        return True  # "*" swallows everything
    return np.startswith(bp)
 
 
def main(path: str):
    data = json.loads(Path(path).expanduser().read_text(encoding="utf-8"))
    perms = data.get("permissions", {})
    found = 0
 
    for bucket, rules in perms.items():
        groups = defaultdict(list)
        for rule in rules:
            m = RULE_RE.match(rule.strip())
            if not m or m.group("arg") is None:
                continue
            groups[m.group("tool")].append((rule, m.group("arg")))
 
        for tool, items in groups.items():
            for broad_rule, broad_arg in items:
                for narrow_rule, narrow_arg in items:
                    if covers(broad_arg, narrow_arg):
                        found += 1
                        print(f"[{bucket}] {narrow_rule}")
                        print(f"         ^ covered by {broad_rule}")
 
    print(f"\nShadowing candidates: {found}")
    print("Approximate. Review every hit by eye before deleting anything.")
    return found
 
 
if __name__ == "__main__":
    sys.exit(0 if main(sys.argv[1] if len(sys.argv) > 1 else "~/.claude/settings.json") == 0 else 0)

The important choice is how conservative covers() is. Broad rules without a trailing wildcard are skipped entirely, and containment is judged on literal prefixes only. Chasing full glob semantics here would eventually mislabel a rule you needed and talk you into deleting it. Missing a candidate is fine; a false positive is not.

Of my 141 deny rules, 34 came back as candidates. After reviewing each one, I removed 28. The remaining 6 were intentional pairs like Bash(git push:*) in ask alongside Bash(git push --force:*) in deny. Different buckets, so the detector never flagged them — and they earn their keep.

Measure the per-turn overhead

You want to know whether the trim actually did anything. When the only variable is the ruleset, running a minimal prompt through claude -p a handful of times is enough.

#!/usr/bin/env bash
# bench_turn.sh — swap rulesets and compare turn time.
#
#   ./bench_turn.sh before.json after.json 10
#
set -euo pipefail
 
SETTINGS_A="${1:?path to the baseline settings.json}"
SETTINGS_B="${2:?path to the trimmed settings.json}"
RUNS="${3:-10}"
PROMPT='Reply with exactly: ok'
 
run_set() {
  local label="$1" settings="$2"
  local times=()
 
  for i in $(seq 1 "$RUNS"); do
    local start end
    start=$(date +%s%N)
    CLAUDE_CONFIG_DIR="$(mktemp -d)" \
      claude -p "$PROMPT" \
      --settings "$settings" \
      --model haiku \
      > /dev/null 2>&1 || true
    end=$(date +%s%N)
    times+=( $(( (end - start) / 1000000 )) )
  done
 
  # Compare medians so the first warm-up run does not drag the average
  local sorted median
  sorted=$(printf '%s\n' "${times[@]}" | sort -n)
  median=$(printf '%s\n' "$sorted" | awk '{a[NR]=$1} END {print (NR%2) ? a[(NR+1)/2] : int((a[NR/2]+a[NR/2+1])/2)}')
  printf '%-10s median=%5s ms   min=%5s ms   max=%5s ms   n=%s\n' \
    "$label" "$median" "$(printf '%s\n' "$sorted" | head -1)" \
    "$(printf '%s\n' "$sorted" | tail -1)" "$RUNS"
  echo "$median"
}
 
echo "=== Rule counts ==="
for f in "$SETTINGS_A" "$SETTINGS_B"; do
  n=$(python3 -c "
import json,sys
p=json.load(open('$f')).get('permissions',{})
print(sum(len(v) for v in p.values()))
")
  printf '  %-40s %s rules\n' "$(basename "$f")" "$n"
done
echo
 
MED_A=$(run_set "before" "$SETTINGS_A" | tail -1)
MED_B=$(run_set "after"  "$SETTINGS_B" | tail -1)
 
echo
awk -v a="$MED_A" -v b="$MED_B" 'BEGIN {
  d = a - b
  printf "delta: %+d ms (%.1f%%)\n", -d, (d / a) * 100
}'

Two details carry this measurement. Pointing CLAUDE_CONFIG_DIR at a throwaway directory each run keeps prior session state out of the numbers, and taking the median keeps the first cold run from skewing the result.

The --model haiku choice is deliberate. What you are timing is session assembly, not inference. The faster and shorter the response, the larger the overhead looms as a fraction of the total — which is what makes it visible.

Going from 226 rules to 154 moved my median by roughly 90ms. That is a sensible size for a post-2.1.209 world, where the caching already did the heavy lifting. Read it the other way, though: if you are still on an older build with hundreds of rules, this is where your seconds are going. Update first, audit second. That order matters.

Fold enumerations into prefixes

Cutting the count is pointless if it opens a hole. What worked for me was to stop enumerating, block one level broader with a prefix, and reopen only the exceptions I actually use.

The "before" is what you get by appending as you go:

{
  "permissions": {
    "deny": [
      "Bash(rm -rf /:*)",
      "Bash(rm -rf ~:*)",
      "Bash(rm -rf /tmp:*)",
      "Bash(rm -rf /var:*)",
      "Bash(rm -rf ./node_modules:*)",
      "Read(./.env)",
      "Read(./.env.local)",
      "Read(./.env.production)",
      "Read(./config/secrets.yml)",
      "Read(./config/master.key)",
      "Bash(curl:*)",
      "Bash(wget:*)"
    ]
  }
}

The "after" blocks broadly, then carves out exceptions:

{
  "permissions": {
    "deny": [
      "Bash(rm -rf:*)",
      "Read(./.env*)",
      "Read(./config/*.key)",
      "Read(./config/secrets*)",
      "Bash(curl:*)",
      "Bash(wget:*)"
    ],
    "allow": [
      "Bash(rm -rf ./node_modules)",
      "Bash(rm -rf ./.next)",
      "Read(./.env.example)"
    ]
  }
}

Twelve lines became nine, but the meaning changed more than the count. The "before" only ever covered the five paths I happened to think of, so rm -rf /usr walked straight through. The "after" blocks rm -rf wholesale and names the two I use daily. Fewer lines, and safer.

Three things I was careful about.

First, the allow exceptions are exact matches with no wildcard. Writing Bash(rm -rf ./node_modules:*) would leave room for rm -rf ./node_modules; rm -rf / to ride along. Exceptions should be as narrow as you can stand.

Second, Read(./.env*) sweeps up .env.example too, so it needs an explicit escape hatch. Broad blocks always produce collateral like this. This is the pitfall that caught me: I folded the rules on a pipeline already in production, and that night's unattended run stalled trying to read .env.example. The workaround is unexciting — block broadly, run a normal day's work by hand once, and promote whatever stalls into allow. Do not let an unattended schedule be the thing that discovers your collateral.

Third, I ran find_shadowed.py again after the rewrite. Folding rules together can quietly create new shadowing of its own.

For assembling deny-by-default in headless runs, see Answering auto mode's confirmation prompts in headless runs — a deny-by-default permission-prompt-tool. If you want the ground floor on what belongs in each bucket, Claude Code Tool Permissions: Custom Allow/Deny Policies is the gentler entry point.

Your MCP tool count carries the same cost

If the weight persists after trimming rules, the tool pool is the next suspect.

In 2.1.209, tool pool assembly in print/SDK sessions is cached, and the payoff scales with tool count — up to 7x. Flip that around and it says something plain: the more tools you expose, the more there was to pay for. Caching does not delete the cost; it folds it into a single occurrence.

Start by counting what you actually have open.

#!/usr/bin/env bash
# count_mcp_tools.sh — count connected MCP servers and their tools.
set -euo pipefail
 
echo "=== Servers declared in config ==="
for f in "$HOME/.claude.json" ".mcp.json"; do
  [ -f "$f" ] || continue
  python3 - "$f" << 'PY'
import json, sys
from pathlib import Path
p = Path(sys.argv[1])
data = json.loads(p.read_text(encoding="utf-8"))
servers = data.get("mcpServers") or {}
# ~/.claude.json can nest servers per project
for proj, cfg in (data.get("projects") or {}).items():
    for name in (cfg.get("mcpServers") or {}):
        servers.setdefault(f"{name} ({proj})", {})
print(f"  {p}: {len(servers)} servers")
for name in sorted(servers):
    print(f"    - {name}")
PY
done
 
echo
echo "=== Tools actually open ==="
claude mcp list 2>/dev/null | sed 's/^/  /' || echo "  (could not read claude mcp list)"

In my case every server lived in the user config regardless of project, so a session for writing articles was dragging a deployment server along for the ride. Assembling tools I will never call is straightforwardly wasted work.

The fix was unglamorous: keep only the servers you use in every project at the user level, and move the rest into a per-project .mcp.json.

{
  "mcpServers": {
    "deploy": {
      "command": "npx",
      "args": ["-y", "@example/deploy-mcp"],
      "env": { "DEPLOY_TOKEN": "${DEPLOY_TOKEN}" }
    }
  }
}

Referencing ${DEPLOY_TOKEN} instead of pasting a real token is what makes this file safe to commit. For the fuller design of scoping servers per project, I wrote up Give an Unattended Agent Only the MCP Tools It Needs — Enforcing a Deny-by-Default Policy.

Where to start, depending on where you are

None of this has to happen in one sitting. This is the rule of thumb I use.

On that last row, Your Overnight Session Wakes Up at 3GB — Four Places Memory Piles Up, and How to Tell Them Apart walks through the isolation steps. Weight that survives a permission trim usually lives over there.

The smallest useful thing to do today

Run audit_permissions.py once and look at the number. That is genuinely enough.

My guess was 60. The answer was 226. That gap was the shape of my design blind spot. Whether to cut anything is a decision you can make after you see the number — sitting on an unexamined "probably fine" is the part that costs you.

Settings added for safety, quietly costing speed. I doubt permissions are the only place that pattern hides. I am still partway through my own audit, but counting alone changed how I look at the file.