PermissionEffect.php
Table of Contents
Enums
- PermissionEffect
- Whether a grant permits an action or refuses it (B1, deny-override). # Precedence Default
deny -> an [`PermissionEffect::Allow`] grant permits -> a [`PermissionEffect::Deny`] grant
refuses, **and beats every allow**, wherever either sits in the resource hierarchy. Deny
wins; there is no most-specific-wins tie-break. That choice is deliberate and is argued in
full in `claude_dev/deny-override-design.md` §2.1. The short version: deny-override buys one
checkable property — **adding a deny rule can never widen access, and can never be undone by
adding allows** — and most-specific-wins buys expressiveness at the cost of making "is X
denied?" unanswerable without enumerating every other rule that might out-specify it.