Claude Code Hands-On (9): settings.json, the Three-Layer Permission Model, and Env

Sun, 26 Apr 2026 09:00:00 +0000

Hooks let you interact with Claude Code, while settings.json specifies what it can access. This file also confuses many with its precedence rules.

This chapter is the missing reference.

The three layers#

There are three settings.json files Claude Code reads, in order:

User settings — ~/.claude/settings.json. Applies to every project on your machine.
Project settings — <repo>/.claude/settings.json. Committed to git. Applies to anyone working in this repo.
Local settings — <repo>/.claude/settings.local.json. Gitignored. Your private overrides for this repo.

The merge rule: later layers override earlier ones, key by key. Permissions are additive for allow, subtractive for deny — once any layer denies something, no other layer can re-allow it. This asymmetry is what makes the system safe.

Claude Code Hands-On (1): Install, the Three-Layer Config, and the # @ /init Trio

Sat, 18 Apr 2026 09:00:00 +0000

This is the first in a ten-part field guide to Claude Code. The order is deliberate: each piece unlocks the next. By the end, you’ll be using features that 90% of users never touch.

Install#

There is one supported install path, and it’s the right one.

Settings-Json on Chen Kai Blog

Claude Code Hands-On (9): settings.json, the Three-Layer Permission Model, and Env

The three layers#

Claude Code Hands-On (1): Install, the Three-Layer Config, and the # @ /init Trio

Install#