Use when deciding which tools an AI agent may call, writing or reviewing a Claude Code permissions block (allow, ask, deny in settings.json), scoping Bash, file read, file edit, web fetch or MCP tool access for one task, or after an agent ran a command it should not have.
