Skip to content

One-Shot Permission Answers for Out-of-Directory Reads

One permission answer clears the read in front of you. The saved answer on the same prompt clears every read outside the working directories.

A one-shot permission answer runs the action the prompt names and saves no rule. Claude Code added one to auto mode's prompt before a read outside the working directories in version 2.1.284. Pick "Yes, but ask again next time" and "the read runs, nothing is saved, and the next read outside the working directories prompts again" (Permission modes). It is the right answer under three conditions: a person is at the prompt, the crossing is unusual, and no narrower grant covers the path. Where crossings are routine, scope the directory instead.

The four answers

In auto mode, while permissions.blockReadsOutsideWorkingDirectories is off, the prompt fires the first time Claude uses Read, Grep, or Glob on a path outside the working directories. Its four answers vary on two things: whether the read runs, and whether your answer outlives it (Permission modes).

Answer The read What it leaves behind
Yes, and keep allowing any reads outside the working directories Runs "Claude Code records your answer so the prompt doesn't appear again"
Yes, but ask again next time Runs Nothing
No, and ask again next time Refused Nothing
No, and block reads outside the working directories from now on Refused permissions.blockReadsOutsideWorkingDirectories set to true in user settings, refusing such reads "in every later session and every permission mode"

Version 2.1.284 added the second row to a prompt that already existed (Claude Code changelog). The changelog lists it as an addition to the existing prompt; the other three answers either save a broad allow, refuse, or refuse and set a block. The same release started interactive terminal and VS Code sessions in auto mode when no permission mode is configured, so the auto-mode prompt now arrives unasked.

Why it works

The saved allow is wider than the evidence the prompt showed. The question is asked about one path; the answer that persists covers "any reads outside the working directories" (Permission modes).

Claude Code offers a save option "only when the prompt can show you everything they would allow, so a rule you save from a prompt covers only what its option named" (Configure permissions). Here the option names a boundary, not a path, so the saved rule is accurate about its reach and still unbounded. The one-shot answer is the only one whose scope equals what you read on screen. It exists for a boundary grant and not for a Bash command, whose saved rule covers the command string the prompt displayed.

One study measured the trade. Per-action approval blocked 59.6% of agent overreach against 39.6% for rules written in advance, and cost 18.0 runtime prompts against 10.9, across 113 participants in three conditions (Yan, 2026). Deciding per call protects more and costs more. The study states its own limit: it analyzed "113 participants without professional software backgrounds", and its focus is everyday tasks "rather than developers using coding agents (e.g., Codex or Claude Code)". Take the direction, not the figures.

When this backfires

  • A toolchain that lives outside the working directories. A vendored dependency tree, a sibling repo, or a language runtime crosses the boundary all day. Adding the directory with /add-dir or permissions.additionalDirectories grants one directory rather than everything past the boundary (Configure permissions).
  • Unattended runs. "The prompt doesn't appear in non-interactive -p runs or background sessions; reads there run as before" (Permission modes). A team that calls this answer its control over out-of-boundary reads has none in the runs nobody watches.
  • Repetition. Users approve 93% of permission prompts already (Claude Code auto mode), and a prompt answered the same way every time collects that reflex. The fatigue mechanism and its cost are covered in Approval Gate Granularity in Agent Pipelines; the within-reviewer decay under repeat exposure is in Reviewer Habituation in Agent PR Review.
  • Reading it as containment. The answer bounds later reads. This file's contents already entered the context, and auto mode's injection probe adds a warning rather than blocking content (Claude Code auto mode).
  • A path that should never be read. "No, and ask again next time" asks again forever. The durable refusal is the setting the fourth answer writes for you.
  • Auditability. Saving nothing records nothing. A permanent Bash or WebFetch approval is saved to .claude/settings.local.json (Configure permissions); a hundred one-shot allows live only in a transcript.

Example

A repository whose Python runtime sits at /usr/lib/python3.12 crosses the boundary on its first dependency read. "Yes, but ask again next time" clears that read and leaves the prompt armed, which is the correct answer once. By the third crossing in an hour the answer is neither prompt option:

/add-dir /usr/lib/python3.12

Files in an added directory "follow the same permission rules as the original working directory" (Configure permissions). One directory opens and the boundary holds everywhere else, which is the part the saved allow would have given away.

Key Takeaways

  • At the prompt, pick "Yes, but ask again next time" for a one-off read. Pick the saved allow only when you accept every path outside the working directories.
  • Check the mode first. The prompt exists in auto mode only; in other modes, scope access with /add-dir or permissions.additionalDirectories.
  • Treat the study figures as direction only. Its participants were not developers (Yan, 2026).
  • It raises reviewer load, and the transcript is the only record that the read was allowed.
  • Count crossings per hour. A third crossing means scope the directory with /add-dir.
Emerging — single recent source Last reviewed: 2026-10-13