Run /fewer-permission-prompts to build an allowlist from your own transcripts

The problem

Approval fatigue pushes people straight to blanket auto-approve. Writing a permissions allowlist by hand is the safe alternative, but you never know which commands to list until you have already been interrupted by them.

The hack

Run `/fewer-permission-prompts`. It scans your transcripts for the read-only Bash and MCP tool calls you keep approving and writes a prioritized allowlist into project `.claude/settings.json`.

Why it works

The allowlist is derived from calls you already approved by hand, so it is scoped to your actual workflow instead of a generic list. You get most of the speed of skipping permissions without granting anything you have not already vetted.

Setup

1. Use Claude Code normally for a few sessions so there is history to learn from. 2. Run `/fewer-permission-prompts`. 3. Review the proposed rules — this writes to project settings, which are shared if you commit them. 4. Trim anything that is not genuinely read-only before accepting. 5. Pair it with deny rules for `.env` reads and `git push` so the allowlist can never widen into something destructive.

Code

# In .claude/settings.json, deny rules are checked before allow rules:
{
  "permissions": {
    "deny": ["Read(./.env)", "Read(./.env.*)", "Bash(git push:*)"]
  }
}

Additional details

Source

Related

• → Allowlist safe Bash commands to stop approval fatigue
• → Prefer auto mode over --dangerously-skip-permissions
• → Enable Bash sandboxing to auto-allow contained commands