When the model emits a ToolUseBlock, nothing actually happens to the world until a separate subsystem answers one question: is this specific call, with these specific arguments, allowed to run right now? That subsystem is the permission-and-dispatch path. Its entry point is runToolUse (claude-code/src/services/tools/toolExecution.ts:337), which hands the call to streamedCheckPermissionsAndCallTool (claude-code/src/services/tools/toolExecution.ts:455) — a thin wrapper that runs checkPermissionsAndCallTool and funnels its progress and final result into a single Stream (claude-code/src/services/tools/toolExecution.ts:492, claude-code/src/services/tools/toolExecution.ts:509). The decision is not a single boolean: it is a layered pipeline of rules, a tool's own self-assessment, mode overrides, lifecycle hooks, and — when still undecided — either an AI classifier or a race between several human-facing approval channels. Only an allow verdict reaches tool.call(...) (claude-code/src/services/tools/toolExecution.ts:1207); a deny becomes a <tool_use_error> returned to the model (claude-code/src/services/tools/toolExecution.ts:1064).

How it works

PreToolUse hooks run first, but cannot launder a banned call. Before any rule check, runPreToolUseHooks executes (claude-code/src/services/tools/toolExecution.ts:800); a hook may yield a hookPermissionResult (claude-code/src/services/tools/toolExecution.ts:832) carrying permissionBehavior of allow, ask, or deny (claude-code/src/services/tools/toolHooks.ts:510), or merely a hookUpdatedInput passthrough that rewrites the arguments without deciding (claude-code/src/services/tools/toolExecution.ts:837). The result is reconciled by resolveHookPermissionDecision (claude-code/src/services/tools/toolHooks.ts:332, invoked at claude-code/src/services/tools/toolExecution.ts:921). The crucial invariant: a hook allow does not bypass settings.json deny/ask rules — it still runs checkRuleBasedPermissions (claude-code/src/services/tools/toolHooks.ts:373), and a matching deny rule overrides the hook approval outright (claude-code/src/services/tools/toolHooks.ts:386). A hook deny returns immediately (claude-code/src/services/tools/toolHooks.ts:408); a hook ask is threaded through as a forceDecision so the dialog shows the hook's message (claude-code/src/services/tools/toolHooks.ts:415). This is the parable's iron rule: even the curator's spoken "lend it" cannot move a book whose name is still in the blacklist.

The rule pipeline. For everything not short-circuited above, control reaches canUseTool (claude-code/src/hooks/useCanUseTool.tsx:32), which calls hasPermissionsToUseTool (claude-code/src/hooks/useCanUseTool.tsx:37, claude-code/src/utils/permissions/permissions.ts:473). Its core, hasPermissionsToUseToolInner (claude-code/src/utils/permissions/permissions.ts:1158), runs the layered checks in order: (1a) a deny rule for the tool → deny (claude-code/src/utils/permissions/permissions.ts:1171); (1b) an ask rule → ask (claude-code/src/utils/permissions/permissions.ts:1184); (1c) the tool's own checkPermissions (claude-code/src/utils/permissions/permissions.ts:1216), whose deny is honored even in bypass mode (claude-code/src/utils/permissions/permissions.ts:1226); (2a) bypassPermissions/plan-with-bypass mode → allow (claude-code/src/utils/permissions/permissions.ts:1268); (2b) an "always allowed" rule → allow (claude-code/src/utils/permissions/permissions.ts:1284); and finally (3) any leftover passthrough is converted to ask (claude-code/src/utils/permissions/permissions.ts:1299) — the parable's "when in doubt, ask." These map one-to-one onto the blacklist, the must-ask register, each book's own rules, the open-browsing pass, and the standing-loan register.

Resolving an ask. An ask is not the end — it must become a concrete allow/deny. The outer hasPermissionsToUseTool first applies mode transforms: dontAsk mode rewrites ask to deny (claude-code/src/utils/permissions/permissions.ts:505); in auto (or active plan) mode an AI classifier is consulted instead of a human (claude-code/src/utils/permissions/permissions.ts:520), but only after two cheap escape hatches — an acceptEdits fast-path that auto-allows safe edits without an API call (claude-code/src/utils/permissions/permissions.ts:600) and a safe-tool allowlist (claude-code/src/utils/permissions/permissions.ts:660) — before finally invoking classifyYoloAction (claude-code/src/utils/permissions/permissions.ts:690). This is the seated assessor who reads the ticket and rules alone. In a headless/async-agent context (shouldAvoidPermissionPrompts), there is no human to ask: PermissionRequest hooks get a chance to allow/deny, and absent any hook decision the call is auto-denied (claude-code/src/utils/permissions/permissions.ts:932).

Interactive dispatch is a race; coordinator dispatch is a queue. When a real prompt is needed, canUseTool routes by session type. Background/coordinator workers take handleCoordinatorPermission (claude-code/src/hooks/useCanUseTool.tsx:95), which awaits the automated checks sequentially — hooks first (claude-code/src/hooks/toolPermission/handlers/coordinatorHandler.ts:33), then the bash classifier (claude-code/src/hooks/toolPermission/handlers/coordinatorHandler.ts:41) — before falling through to the dialog (claude-code/src/hooks/toolPermission/handlers/coordinatorHandler.ts:59), avoiding async-context hazards. The normal interactive session takes handleInteractivePermission (claude-code/src/hooks/useCanUseTool.tsx:160, claude-code/src/hooks/toolPermission/handlers/interactiveHandler.ts:57), which fires several approval channels in parallel and lets the first responder win: the bridge relay to claude.ai (claude-code/src/hooks/toolPermission/handlers/interactiveHandler.ts:244), the channel relay to Telegram/iMessage (claude-code/src/hooks/toolPermission/handlers/interactiveHandler.ts:316), the async PermissionRequest hooks (claude-code/src/hooks/toolPermission/handlers/interactiveHandler.ts:411), and the async bash classifier (claude-code/src/hooks/toolPermission/handlers/interactiveHandler.ts:434) — all alongside the local terminal dialog as the floor. The atomicity that makes this safe is createResolveOnce's claim() token (claude-code/src/hooks/toolPermission/handlers/interactiveHandler.ts:70): every racer's callback calls claim() before resolving (claude-code/src/hooks/toolPermission/handlers/interactiveHandler.ts:160), so the first winner takes the token and every later response simply no-ops. That is the single signing-chit on the desk.

Acting on the verdict. The resolved PermissionDecision returns to checkPermissionsAndCallTool. If it is anything other than allow, the harness logs the rejection and returns a tool_result error to the model (claude-code/src/services/tools/toolExecution.ts:995, claude-code/src/services/tools/toolExecution.ts:1064). If it is allow, any permission-supplied updatedInput replaces the model's arguments (claude-code/src/services/tools/toolExecution.ts:1130) — with a special case that restores the model's original file_path when a backfilled value matches, to keep transcript/VCR hashes stable (claude-code/src/services/tools/toolExecution.ts:1189) — and only then does tool.call(...) execute (claude-code/src/services/tools/toolExecution.ts:1207). Afterward, PostToolUse hooks may even rewrite an MCP tool's output (claude-code/src/services/tools/toolExecution.ts:1483, claude-code/src/services/tools/toolExecution.ts:1494).

Why it matters

Every decision carries a decisionReason whose type records its source — rule, hook, classifier, mode, safety check (claude-code/src/hooks/toolPermission/permissionLogging.ts:29) — and logPermissionDecision is the single fan-out point that turns each verdict into analytics events, an OTel tool_decision event (claude-code/src/hooks/toolPermission/permissionLogging.ts:230), and a toolUseContext.toolDecisions map entry for downstream inspection (claude-code/src/hooks/toolPermission/permissionLogging.ts:224); the headless path emits the same OTel event directly (claude-code/src/services/tools/toolExecution.ts:962). This layering is what lets one harness be safe by default yet flexible: a deny rule is absolute (no hook, no mode, no classifier can override it), an ask always has a deterministic resolver (classifier, race, or queue) so a tool never silently hangs, and the claim() token guarantees that four parallel approval surfaces resolve exactly one decision. The model proposes; this gate disposes — and only its allow ever touches the world.

Read the source

• Entry and streaming wrapper: claude-code/src/services/tools/toolExecution.ts:337, claude-code/src/services/tools/toolExecution.ts:455, claude-code/src/services/tools/toolExecution.ts:492.
• Hooks-first and the deny-overrides-hook invariant: claude-code/src/services/tools/toolExecution.ts:800, claude-code/src/services/tools/toolHooks.ts:332, claude-code/src/services/tools/toolHooks.ts:386, claude-code/src/services/tools/toolHooks.ts:510.
• The layered rule pipeline, 1a→3: claude-code/src/utils/permissions/permissions.ts:1158, claude-code/src/utils/permissions/permissions.ts:1171, claude-code/src/utils/permissions/permissions.ts:1184, claude-code/src/utils/permissions/permissions.ts:1216, claude-code/src/utils/permissions/permissions.ts:1268, claude-code/src/utils/permissions/permissions.ts:1284, claude-code/src/utils/permissions/permissions.ts:1299.
• Resolving ask — classifier, fast-paths, headless: claude-code/src/utils/permissions/permissions.ts:520, claude-code/src/utils/permissions/permissions.ts:600, claude-code/src/utils/permissions/permissions.ts:660, claude-code/src/utils/permissions/permissions.ts:932.
• Dispatch — interactive race vs. coordinator queue, with claim() atomicity: claude-code/src/hooks/useCanUseTool.tsx:160, claude-code/src/hooks/toolPermission/handlers/interactiveHandler.ts:70, claude-code/src/hooks/toolPermission/handlers/interactiveHandler.ts:244, claude-code/src/hooks/toolPermission/handlers/interactiveHandler.ts:434, claude-code/src/hooks/toolPermission/handlers/coordinatorHandler.ts:33.
• Acting on the verdict — deny error, updatedInput, tool.call: claude-code/src/services/tools/toolExecution.ts:1064, claude-code/src/services/tools/toolExecution.ts:1130, claude-code/src/services/tools/toolExecution.ts:1207.
• Logging the decision source: claude-code/src/hooks/toolPermission/permissionLogging.ts:181, claude-code/src/hooks/toolPermission/permissionLogging.ts:230.