Writing Rules That Hold

Advanced

Deny beats ask beats allow — and argument-matching patterns are weaker than they look

Practice activities and scenarios are optional. Mark the lesson complete after reading, and return to practice whenever it helps.

Restoring your saved work…

07 Optional practice

🧠 Optional scenario practice

Q1 Why is "deny": ["Write(secrets/**)"] an ineffective rule?

Q2 In user settings at ~/.claude/settings.json, what does Read(/secrets/**) protect?

📝 Notes