LC Signal AI & Data

Claude Code Fixes Permission Controls: Deny Rules Now Apply to Compound Commands and File References

On October 4 (Japan time), Anthropic released v2.1.289
of Claude Code, its AI tool for software development.
The update fixes issues in which deny and ask rules did not apply
to commands that combine multiple operations
or to files referenced through symbolic links.
It is an update concerning operational permissions
when delegating development work to AI.

What Changes: Fixes to Execution and Read Restrictions

According to the official release notes, the update fixes an issue
on organization-managed machines in which a deny or ask rule
on a nested part of a compound shell command
did not hold over the approval of a user-installed extension called a mod.
The fix ensures that restrictions set on part of a command
still apply when multiple operations are combined.

File reads were also fixed.
The update resolves an issue in which Read deny rules
did not apply to files mentioned, changed, or selected
in the development environment when referenced through a symbolic link.
A symbolic link is a mechanism that refers to another file or folder by name.

The update also fixes two issues in which Bash deny and ask rules
did not apply when the sandbox automatically allows commands.
The rules were not applied to commands preceded by
an environment variable with an expanded value,
or when a bare variable assignment came before the command.

Permission Rules Control the Tools AI Uses

The official Claude Code documentation describes three types
of permission rules: allow, ask, and deny.
Allow rules permit specified actions without manual approval,
ask rules request confirmation before running,
and deny rules block the action.
Command execution and file access are among the actions they control.

The documentation also states that permission rules are enforced
by Claude Code itself.
Instructions written in a prompt or in CLAUDE.md shape what the AI tries to do,
but they do not change the settings that allow or deny tool use.
For organizations, a mechanism is also available for administrators
to distribute settings centrally.

Fixes to Extensions and Display Issues

The update also fixes an issue in which a user-installed plugin
could rewrite the descriptions of sign-in tools
on an organization-managed MCP server.
MCP is a standard for connecting AI applications
to external data, tools, and other systems.

In addition, the update fixes the terminal freezing on certain code displays
and improves how quickly large files open in a plugin code pane.
Alongside permission controls, it includes fixes that help users
keep working while using extensions.

LC Signal’s Perspective: Applying Restrictions to Delegated Work

The fixes target specific cases: compound commands,
commands involving variable assignments,
file references through links, and organization-managed connection tools.
They address issues in which denied operations or reads
could fall outside restrictions depending on how operations were combined
or which path was used to reach a file.

Claude Code offers settings not only to allow actions
but also to require confirmation or block them.
For companies expanding the scope of work they delegate to AI,
having the restrictions they set reflected in actual operations
seems likely to be a practical improvement for everyday development.

Key Sources

This article was prepared with AI assistance using publicly available information
as of October 5, 2026.
The release date is converted to Japan time from the time shown on GitHub;
it corresponds to October 3 in UTC and October 4 in Japan time.
Update details are based on the official release notes
and have not been verified on an actual system.
Explanations of terms refer to official materials from GNU Coreutils and MCP.
“LC Signal’s Perspective” reflects this publication’s interpretation
of the available information.

Back to LC Signal