Show HN: A police department for your Claude Code agents

Post by softie123 » Thu, Jun 11, 2026, 5:47 PM UTC

Post by KaiShips » Thu, Jun 11, 2026, 7:02 PM UTC

Post by tomaytotomato » Thu, Jun 11, 2026, 7:17 PM UTC

    "permissions": {
    "allow": [
      "Bash(npm run lint)",
      "Bash(npm run test *)",
      "Read(~/.zshrc)"
    ],
    "deny": [
      "Bash(curl *)",
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)"
    ]
  },

Post by abirch » Thu, Jun 11, 2026, 7:36 PM UTC

FishAngular12 wrote: post #6

tomaytotomato wrote: post #5

Not a criticism, but why would I use this instead of locking down my Claude using the allow/deny permissions list? "permissions": { "allow": [ "Bash(npm run lint)", "Bash(npm run test *)", "Read(~/.zshrc)" ], "deny": [ "Bash(curl *)", "Read(./.env)", "Read(./.env.*)", "Read(./secrets/**)" ] },

Where would one put this? In AGENTS.md?

Post by tenuousemphasis » Thu, Jun 11, 2026, 10:37 PM UTC

softie123 wrote: post #8

tomaytotomato wrote: post #5

Not a criticism, but why would I use this instead of locking down my Claude using the allow/deny permissions list? "permissions": { "allow": [ "Bash(npm run lint)", "Bash(npm run test *)", "Read(~/.zshrc)" ], "deny": [ "Bash(curl *)", "Read(./.env)", "Read(./.env.*)", "Read(./secrets/**)" ] },

Idea is not to deny permissions to everything but just keep a log on what the agents are doing thats not in line with our permissions and also you have to know what they are bypassing so we can put them in deny list later. Very useful when you spawn many agents working in parallel. This is more of an observability tool.