Per-tool permission rules decide allow ask or deny for each call

Beneath the session mode sits a finer gate: a per-tool permission rule that decides each call. OpenCode resolves every tool call to allow, ask, or deny, with pattern matching so "rm *": "deny" and "git *": "allow" can coexist, and the last matching rule wins. Claude Code layers the same allow/ask/deny vocabulary on top of whatever mode is active.

This is where the policy gets specific. A mode says “ask often” or “ask rarely”; the rules say which commands and paths actually trigger the prompt, and which a human has pre-approved. Some decisions sit outside both: Claude Code’s protected paths (.git, .claude, shell rcfiles) are never auto-approved regardless of mode or allow rule, because corrupting repository state or the agent’s own config is too costly to let through silently. Rules are the layer that turns a general stance (see: a permission mode toggle sets baseline oversight per session) into concrete, per-action gating.