canUseTool callback to handle everything else at runtime.
How permissions are evaluated
When Claude requests a tool, the SDK checks permissions in this order:1
Hooks
Run hooks first. A hook can deny the call outright or pass it on. A hook that returns
allow does not skip the deny and ask rules below; those are evaluated regardless of the hook result. A PreToolUse hook allow also can’t approve an rm or rmdir removal targeting a critical path.2
Deny rules
Check
deny rules (from disallowed_tools and settings.json). If a deny rule matches, the tool is blocked, even in bypassPermissions mode. Bare-name deny rules like Bash remove the tool from Claude’s context before this evaluation begins, so only scoped rules like Bash(rm *) are checked at this step.3
Ask rules
Check
ask rules from settings.json. If an ask rule matches, the call falls through to your canUseTool callback for confirmation, even in bypassPermissions mode.Tools that require user interaction behave the same way: AskUserQuestion and MCP tools whose server sets _meta["anthropic/requiresUserInteraction"] always fall through to the callback, even when an allow rule matches. In dontAsk mode both cases are denied instead, because that mode never prompts. The MCP annotation requires Claude Code v2.1.199 or later.claude.ai connector tools your organization has set to ask also leave the flow at this step. Every call falls through to the callback, even in bypassPermissions mode and even when an allow rule matches. The callback receives the reason Your organization requires approval for this tool. In dontAsk mode the call is denied instead, because that mode never prompts.4
Permission mode
Apply the active permission mode.
bypassPermissions approves everything that reaches this step except rm and rmdir removals targeting a critical path, which fall through instead. acceptEdits approves the file operations listed under Accept edits mode.