Claude Code Tool System 与 Permission 机制深度解析
0. 背景与定位
Claude Code 是一个运行在终端的 Agentic 编码工具，其核心能力来自工具系统（Tool System）——AI 通过调用工具与文件系统、Shell、网络、子 Agent 交互。而**权限系统（Permission System）**则是这套能力的安全护城河，决定哪些工具调用可以自动执行、哪些需要用户确认、哪些被永久拒绝。
理解这两个系统，是在企业内安全部署 Claude Code、或基于 SDK 构建自定义 AI Agent 的前提。 1
1. 核心概念速览
| Tool | AI Agent 可调用的能力单元，如 BashTool、FileReadTool |
| ToolRegistry | 工具注册表，管理所有可用工具的生命周期 |
| PermissionChecker | 权限检查器，每次工具调用前执行 |
| Permission Mode | 全局权限模式：default / acceptEdits / auto / bypassPermissions |
| Hook | 工具执行前后的生命周期钩子，可拦截、修改、阻断 |
| Sandbox | 针对 BashTool 的沙箱隔离层，控制网络与文件系统访问 |
| Settings Hierarchy | 配置优先级链：managed-settings.json > settings.json > settings.local.json |
2. 工具系统架构
2.1 工具分类总览
Claude Code 内置以下核心工具类： 2
| 文件操作 | FileReadTool | 读取文件，支持 token 感知截断 |
| FileWriteTool | 创建/覆盖文件，含路径安全校验 | |
| FileEditTool | 行级 diff 编辑，含符号链接检查 | |
| Shell 执行 | BashTool | 执行 Shell 命令，支持沙箱模式 |
| PowerShellTool | Windows 环境专用 Shell | |
| 网络 | WebFetchTool | 抓取 URL 内容 |
| WebSearchTool | 执行网络搜索 | |
| Agent 编排 | TaskTool | 派生子 Agent（支持 Worktree 隔离） |
| EnterWorktree | 切换 Claude 管理的 Git Worktree | |
| 交互 | AskUserQuestion | 向用户提问 |
| 扩展 | MCP Tools | 通过 Model Context Protocol 接入外部工具 |
注意： sandbox 属性仅作用于 BashTool，不影响 Read、Write、WebFetch、MCP 等其他工具。
2.2 工具执行全链路流程
3. 权限系统深度解析
3.1 权限判断链路（Settings Hierarchy）
权限规则按以下优先级从高到低依次检查，高优先级规则可覆盖低优先级：
#mermaid-svg-PbqzJAA2HnTNsLyF{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-PbqzJAA2HnTNsLyF .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-PbqzJAA2HnTNsLyF .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-PbqzJAA2HnTNsLyF .error-icon{fill:#552222;}#mermaid-svg-PbqzJAA2HnTNsLyF .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-PbqzJAA2HnTNsLyF .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-PbqzJAA2HnTNsLyF .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-PbqzJAA2HnTNsLyF .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-PbqzJAA2HnTNsLyF .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-PbqzJAA2HnTNsLyF .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-PbqzJAA2HnTNsLyF .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-PbqzJAA2HnTNsLyF .marker{fill:#333333;stroke:#333333;}#mermaid-svg-PbqzJAA2HnTNsLyF .marker.cross{stroke:#333333;}#mermaid-svg-PbqzJAA2HnTNsLyF svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-PbqzJAA2HnTNsLyF p{margin:0;}#mermaid-svg-PbqzJAA2HnTNsLyF .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-PbqzJAA2HnTNsLyF .cluster-label text{fill:#333;}#mermaid-svg-PbqzJAA2HnTNsLyF .cluster-label span{color:#333;}#mermaid-svg-PbqzJAA2HnTNsLyF .cluster-label span p{background-color:transparent;}#mermaid-svg-PbqzJAA2HnTNsLyF .label text,#mermaid-svg-PbqzJAA2HnTNsLyF span{fill:#333;color:#333;}#mermaid-svg-PbqzJAA2HnTNsLyF .node rect,#mermaid-svg-PbqzJAA2HnTNsLyF .node circle,#mermaid-svg-PbqzJAA2HnTNsLyF .node ellipse,#mermaid-svg-PbqzJAA2HnTNsLyF .node polygon,#mermaid-svg-PbqzJAA2HnTNsLyF .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-PbqzJAA2HnTNsLyF .rough-node .label text,#mermaid-svg-PbqzJAA2HnTNsLyF .node .label text,#mermaid-svg-PbqzJAA2HnTNsLyF .image-shape .label,#mermaid-svg-PbqzJAA2HnTNsLyF .icon-shape .label{text-anchor:middle;}#mermaid-svg-PbqzJAA2HnTNsLyF .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-PbqzJAA2HnTNsLyF .rough-node .label,#mermaid-svg-PbqzJAA2HnTNsLyF .node .label,#mermaid-svg-PbqzJAA2HnTNsLyF .image-shape .label,#mermaid-svg-PbqzJAA2HnTNsLyF .icon-shape .label{text-align:center;}#mermaid-svg-PbqzJAA2HnTNsLyF .node.clickable{cursor:pointer;}#mermaid-svg-PbqzJAA2HnTNsLyF .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-PbqzJAA2HnTNsLyF .arrowheadPath{fill:#333333;}#mermaid-svg-PbqzJAA2HnTNsLyF .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-PbqzJAA2HnTNsLyF .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-PbqzJAA2HnTNsLyF .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-PbqzJAA2HnTNsLyF .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-PbqzJAA2HnTNsLyF .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-PbqzJAA2HnTNsLyF .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-PbqzJAA2HnTNsLyF .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-PbqzJAA2HnTNsLyF .cluster text{fill:#333;}#mermaid-svg-PbqzJAA2HnTNsLyF .cluster span{color:#333;}#mermaid-svg-PbqzJAA2HnTNsLyF div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-PbqzJAA2HnTNsLyF .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-PbqzJAA2HnTNsLyF rect.text{fill:none;stroke-width:0;}#mermaid-svg-PbqzJAA2HnTNsLyF .icon-shape,#mermaid-svg-PbqzJAA2HnTNsLyF .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-PbqzJAA2HnTNsLyF .icon-shape p,#mermaid-svg-PbqzJAA2HnTNsLyF .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-PbqzJAA2HnTNsLyF .icon-shape .label rect,#mermaid-svg-PbqzJAA2HnTNsLyF .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-PbqzJAA2HnTNsLyF .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-PbqzJAA2HnTNsLyF .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-PbqzJAA2HnTNsLyF :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}
交互式确认选项
Deny
Allow
无匹配
allowManagedPermissionRulesOnly: true
命中 deny
命中 allow
命中 ask
无匹配
命中规则
无匹配
工具调用请求
① 检查 managed-settings.json企业 MDM 下发的托管策略
执行被阻断 ❌
直接执行 ✅
② 检查 settings.json用户/项目级配置
交互式确认
③ 检查 settings.local.json本地覆盖配置
仅此一次允许
始终允许(持久化到 settings.json)
拒绝
3.2 三种权限规则类型
// settings.json 示例
{
"permissions": {
"allow": [
"Bash(git log:*)",
"Bash(npm test)",
"Read(**)"
],
"ask": [
"Bash"
],
"deny": [
"WebSearch",
"WebFetch"
]
}
}
| allow | 自动批准，无需确认 | 只读命令、安全的 git 操作 |
| ask | 每次都弹出确认 | 高风险工具如 Bash |
| deny | 永久拒绝，不可绕过 | 禁止网络访问、禁止特定工具 |
通配符语法示例：
- Bash(npm *) — 匹配所有 npm 子命令
- Bash(git * main) — 匹配操作 main 分支的 git 命令
- Read(**) — 匹配所有文件读取
- Edit(/src/**) — 仅允许编辑 src 目录
3.3 四种全局权限模式
#mermaid-svg-pqoiZXZDnz3EOTsw{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-pqoiZXZDnz3EOTsw .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-pqoiZXZDnz3EOTsw .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-pqoiZXZDnz3EOTsw .error-icon{fill:#552222;}#mermaid-svg-pqoiZXZDnz3EOTsw .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-pqoiZXZDnz3EOTsw .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-pqoiZXZDnz3EOTsw .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-pqoiZXZDnz3EOTsw .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-pqoiZXZDnz3EOTsw .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-pqoiZXZDnz3EOTsw .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-pqoiZXZDnz3EOTsw .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-pqoiZXZDnz3EOTsw .marker{fill:#333333;stroke:#333333;}#mermaid-svg-pqoiZXZDnz3EOTsw .marker.cross{stroke:#333333;}#mermaid-svg-pqoiZXZDnz3EOTsw svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-pqoiZXZDnz3EOTsw p{margin:0;}#mermaid-svg-pqoiZXZDnz3EOTsw .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-pqoiZXZDnz3EOTsw .cluster-label text{fill:#333;}#mermaid-svg-pqoiZXZDnz3EOTsw .cluster-label span{color:#333;}#mermaid-svg-pqoiZXZDnz3EOTsw .cluster-label span p{background-color:transparent;}#mermaid-svg-pqoiZXZDnz3EOTsw .label text,#mermaid-svg-pqoiZXZDnz3EOTsw span{fill:#333;color:#333;}#mermaid-svg-pqoiZXZDnz3EOTsw .node rect,#mermaid-svg-pqoiZXZDnz3EOTsw .node circle,#mermaid-svg-pqoiZXZDnz3EOTsw .node ellipse,#mermaid-svg-pqoiZXZDnz3EOTsw .node polygon,#mermaid-svg-pqoiZXZDnz3EOTsw .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-pqoiZXZDnz3EOTsw .rough-node .label text,#mermaid-svg-pqoiZXZDnz3EOTsw .node .label text,#mermaid-svg-pqoiZXZDnz3EOTsw .image-shape .label,#mermaid-svg-pqoiZXZDnz3EOTsw .icon-shape .label{text-anchor:middle;}#mermaid-svg-pqoiZXZDnz3EOTsw .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-pqoiZXZDnz3EOTsw .rough-node .label,#mermaid-svg-pqoiZXZDnz3EOTsw .node .label,#mermaid-svg-pqoiZXZDnz3EOTsw .image-shape .label,#mermaid-svg-pqoiZXZDnz3EOTsw .icon-shape .label{text-align:center;}#mermaid-svg-pqoiZXZDnz3EOTsw .node.clickable{cursor:pointer;}#mermaid-svg-pqoiZXZDnz3EOTsw .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-pqoiZXZDnz3EOTsw .arrowheadPath{fill:#333333;}#mermaid-svg-pqoiZXZDnz3EOTsw .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-pqoiZXZDnz3EOTsw .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-pqoiZXZDnz3EOTsw .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-pqoiZXZDnz3EOTsw .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-pqoiZXZDnz3EOTsw .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-pqoiZXZDnz3EOTsw .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-pqoiZXZDnz3EOTsw .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-pqoiZXZDnz3EOTsw .cluster text{fill:#333;}#mermaid-svg-pqoiZXZDnz3EOTsw .cluster span{color:#333;}#mermaid-svg-pqoiZXZDnz3EOTsw div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-pqoiZXZDnz3EOTsw .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-pqoiZXZDnz3EOTsw rect.text{fill:none;stroke-width:0;}#mermaid-svg-pqoiZXZDnz3EOTsw .icon-shape,#mermaid-svg-pqoiZXZDnz3EOTsw .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-pqoiZXZDnz3EOTsw .icon-shape p,#mermaid-svg-pqoiZXZDnz3EOTsw .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-pqoiZXZDnz3EOTsw .icon-shape .label rect,#mermaid-svg-pqoiZXZDnz3EOTsw .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-pqoiZXZDnz3EOTsw .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-pqoiZXZDnz3EOTsw .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-pqoiZXZDnz3EOTsw :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}
权限模式 (Shift+Tab 循环切换)
Shift+Tab
Shift+Tab
Shift+Tab
Shift+Tab
default默认模式每次工具调用均需确认
acceptEdits接受编辑模式文件操作自动批准Bash 仍需确认
auto自动模式内置分类器自动判断危险操作仍会拦截
bypassPermissions跳过权限模式⚠️ 危险：跳过所有检查
安全提示： bypassPermissions 模式可通过 disableBypassPermissionsMode: "disable" 在企业策略中永久禁用。 10
4. Hook 系统：工具执行的生命周期拦截
Hook 是权限系统的重要扩展点，允许在工具执行的各个阶段注入自定义逻辑。
4.1 Hook 生命周期全景
渲染错误: Mermaid 渲染失败: Parse error on line 28: …最终响应```[11](#0-10) ### 4.2 Hook 事件类型速 ———————-^ Expecting '()', 'SOLID_OPEN_ARROW', 'DOTTED_OPEN_ARROW', 'SOLID_ARROW', 'SOLID_ARROW_TOP', 'SOLID_ARROW_BOTTOM', 'STICK_ARROW_TOP', 'STICK_ARROW_BOTTOM', 'SOLID_ARROW_TOP_DOTTED', 'SOLID_ARROW_BOTTOM_DOTTED', 'STICK_ARROW_TOP_DOTTED', 'STICK_ARROW_BOTTOM_DOTTED', 'SOLID_ARROW_TOP_REVERSE', 'SOLID_ARROW_BOTTOM_REVERSE', 'STICK_ARROW_TOP_REVERSE', 'STICK_ARROW_BOTTOM_REVERSE', 'SOLID_ARROW_TOP_REVERSE_DOTTED', 'SOLID_ARROW_BOTTOM_REVERSE_DOTTED', 'STICK_ARROW_TOP_REVERSE_DOTTED', 'STICK_ARROW_BOTTOM_REVERSE_DOTTED', 'BIDIRECTIONAL_SOLID_ARROW', 'DOTTED_ARROW', 'BIDIRECTIONAL_DOTTED_ARROW', 'SOLID_CROSS', 'DOTTED_CROSS', 'SOLID_POINT', 'DOTTED_POINT', got 'NEWLINE'
6. 企业部署配置参考
6.1 三种典型配置对比 15
| 禁用 –dangerously-skip-permissions | ✅ | ✅ | |
| 屏蔽插件市场 | ✅ | ✅ | |
| 禁止用户自定义权限规则 | ✅ | ✅ | |
| 禁止用户自定义 Hook | ✅ | ||
| 拒绝 WebFetch/WebSearch | ✅ | ||
| Bash 工具需要审批 | ✅ | ||
| Bash 工具必须在沙箱内运行 | ✅ |
6.2 安全加固关键配置
// managed-settings.json (企业 MDM 下发)
{
"permissions": {
"disableBypassPermissionsMode": "disable",
"deny": ["WebSearch", "WebFetch"],
"ask": ["Bash"]
},
"allowManagedPermissionRulesOnly": true,
"allowManagedHooksOnly": true,
"sandbox": {
"enabled": true,
"network": {
"allowedDomains": ["registry.npmjs.org", "api.github.com"]
}
}
}
7. 架构设计建议
7.1 安全性维度
#mermaid-svg-UpCN0Pa9x64MTFMG{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-UpCN0Pa9x64MTFMG .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-UpCN0Pa9x64MTFMG .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-UpCN0Pa9x64MTFMG .error-icon{fill:#552222;}#mermaid-svg-UpCN0Pa9x64MTFMG .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-UpCN0Pa9x64MTFMG .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-UpCN0Pa9x64MTFMG .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-UpCN0Pa9x64MTFMG .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-UpCN0Pa9x64MTFMG .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-UpCN0Pa9x64MTFMG .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-UpCN0Pa9x64MTFMG .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-UpCN0Pa9x64MTFMG .marker{fill:#333333;stroke:#333333;}#mermaid-svg-UpCN0Pa9x64MTFMG .marker.cross{stroke:#333333;}#mermaid-svg-UpCN0Pa9x64MTFMG svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-UpCN0Pa9x64MTFMG p{margin:0;}#mermaid-svg-UpCN0Pa9x64MTFMG .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-UpCN0Pa9x64MTFMG .cluster-label text{fill:#333;}#mermaid-svg-UpCN0Pa9x64MTFMG .cluster-label span{color:#333;}#mermaid-svg-UpCN0Pa9x64MTFMG .cluster-label span p{background-color:transparent;}#mermaid-svg-UpCN0Pa9x64MTFMG .label text,#mermaid-svg-UpCN0Pa9x64MTFMG span{fill:#333;color:#333;}#mermaid-svg-UpCN0Pa9x64MTFMG .node rect,#mermaid-svg-UpCN0Pa9x64MTFMG .node circle,#mermaid-svg-UpCN0Pa9x64MTFMG .node ellipse,#mermaid-svg-UpCN0Pa9x64MTFMG .node polygon,#mermaid-svg-UpCN0Pa9x64MTFMG .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-UpCN0Pa9x64MTFMG .rough-node .label text,#mermaid-svg-UpCN0Pa9x64MTFMG .node .label text,#mermaid-svg-UpCN0Pa9x64MTFMG .image-shape .label,#mermaid-svg-UpCN0Pa9x64MTFMG .icon-shape .label{text-anchor:middle;}#mermaid-svg-UpCN0Pa9x64MTFMG .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-UpCN0Pa9x64MTFMG .rough-node .label,#mermaid-svg-UpCN0Pa9x64MTFMG .node .label,#mermaid-svg-UpCN0Pa9x64MTFMG .image-shape .label,#mermaid-svg-UpCN0Pa9x64MTFMG .icon-shape .label{text-align:center;}#mermaid-svg-UpCN0Pa9x64MTFMG .node.clickable{cursor:pointer;}#mermaid-svg-UpCN0Pa9x64MTFMG .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-UpCN0Pa9x64MTFMG .arrowheadPath{fill:#333333;}#mermaid-svg-UpCN0Pa9x64MTFMG .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-UpCN0Pa9x64MTFMG .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-UpCN0Pa9x64MTFMG .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-UpCN0Pa9x64MTFMG .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-UpCN0Pa9x64MTFMG .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-UpCN0Pa9x64MTFMG .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-UpCN0Pa9x64MTFMG .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-UpCN0Pa9x64MTFMG .cluster text{fill:#333;}#mermaid-svg-UpCN0Pa9x64MTFMG .cluster span{color:#333;}#mermaid-svg-UpCN0Pa9x64MTFMG div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-UpCN0Pa9x64MTFMG .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-UpCN0Pa9x64MTFMG rect.text{fill:none;stroke-width:0;}#mermaid-svg-UpCN0Pa9x64MTFMG .icon-shape,#mermaid-svg-UpCN0Pa9x64MTFMG .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-UpCN0Pa9x64MTFMG .icon-shape p,#mermaid-svg-UpCN0Pa9x64MTFMG .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-UpCN0Pa9x64MTFMG .icon-shape .label rect,#mermaid-svg-UpCN0Pa9x64MTFMG .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-UpCN0Pa9x64MTFMG .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-UpCN0Pa9x64MTFMG .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-UpCN0Pa9x64MTFMG :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}
防御纵深
managed-settings 锁定基线
PreToolUse Hook 二次校验
Sandbox 网络隔离
最小权限原则
默认 deny 所有网络工具
按需 allow 特定域名
Bash 工具默认 ask
仅 allow 只读命令
- 永远不要在 CI/CD 中使用 –dangerously-skip-permissions，除非在完全隔离的沙箱容器内
- 使用 allowManagedPermissionRulesOnly: true 防止项目级配置绕过企业策略
- PreToolUse Hook 可作为命令注入的最后防线
7.2 可扩展性维度
- MCP 工具：通过 Model Context Protocol 接入内部系统（数据库、CI、监控），无需修改 Claude Code 核心
- Hook 中间件：PreToolUse 返回 updatedInput 可实现工具输入的透明改写（如自动注入项目前缀）
- PermissionRequest Hook：可实现自定义审批逻辑（如 Slack 审批流） 17
7.3 企业部署维度
#mermaid-svg-BDIanrfhg3gg7TRO{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-BDIanrfhg3gg7TRO .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-BDIanrfhg3gg7TRO .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-BDIanrfhg3gg7TRO .error-icon{fill:#552222;}#mermaid-svg-BDIanrfhg3gg7TRO .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-BDIanrfhg3gg7TRO .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-BDIanrfhg3gg7TRO .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-BDIanrfhg3gg7TRO .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-BDIanrfhg3gg7TRO .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-BDIanrfhg3gg7TRO .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-BDIanrfhg3gg7TRO .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-BDIanrfhg3gg7TRO .marker{fill:#333333;stroke:#333333;}#mermaid-svg-BDIanrfhg3gg7TRO .marker.cross{stroke:#333333;}#mermaid-svg-BDIanrfhg3gg7TRO svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-BDIanrfhg3gg7TRO p{margin:0;}#mermaid-svg-BDIanrfhg3gg7TRO .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-BDIanrfhg3gg7TRO .cluster-label text{fill:#333;}#mermaid-svg-BDIanrfhg3gg7TRO .cluster-label span{color:#333;}#mermaid-svg-BDIanrfhg3gg7TRO .cluster-label span p{background-color:transparent;}#mermaid-svg-BDIanrfhg3gg7TRO .label text,#mermaid-svg-BDIanrfhg3gg7TRO span{fill:#333;color:#333;}#mermaid-svg-BDIanrfhg3gg7TRO .node rect,#mermaid-svg-BDIanrfhg3gg7TRO .node circle,#mermaid-svg-BDIanrfhg3gg7TRO .node ellipse,#mermaid-svg-BDIanrfhg3gg7TRO .node polygon,#mermaid-svg-BDIanrfhg3gg7TRO .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-BDIanrfhg3gg7TRO .rough-node .label text,#mermaid-svg-BDIanrfhg3gg7TRO .node .label text,#mermaid-svg-BDIanrfhg3gg7TRO .image-shape .label,#mermaid-svg-BDIanrfhg3gg7TRO .icon-shape .label{text-anchor:middle;}#mermaid-svg-BDIanrfhg3gg7TRO .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-BDIanrfhg3gg7TRO .rough-node .label,#mermaid-svg-BDIanrfhg3gg7TRO .node .label,#mermaid-svg-BDIanrfhg3gg7TRO .image-shape .label,#mermaid-svg-BDIanrfhg3gg7TRO .icon-shape .label{text-align:center;}#mermaid-svg-BDIanrfhg3gg7TRO .node.clickable{cursor:pointer;}#mermaid-svg-BDIanrfhg3gg7TRO .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-BDIanrfhg3gg7TRO .arrowheadPath{fill:#333333;}#mermaid-svg-BDIanrfhg3gg7TRO .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-BDIanrfhg3gg7TRO .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-BDIanrfhg3gg7TRO .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-BDIanrfhg3gg7TRO .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-BDIanrfhg3gg7TRO .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-BDIanrfhg3gg7TRO .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-BDIanrfhg3gg7TRO .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-BDIanrfhg3gg7TRO .cluster text{fill:#333;}#mermaid-svg-BDIanrfhg3gg7TRO .cluster span{color:#333;}#mermaid-svg-BDIanrfhg3gg7TRO div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-BDIanrfhg3gg7TRO .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-BDIanrfhg3gg7TRO rect.text{fill:none;stroke-width:0;}#mermaid-svg-BDIanrfhg3gg7TRO .icon-shape,#mermaid-svg-BDIanrfhg3gg7TRO .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-BDIanrfhg3gg7TRO .icon-shape p,#mermaid-svg-BDIanrfhg3gg7TRO .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-BDIanrfhg3gg7TRO .icon-shape .label rect,#mermaid-svg-BDIanrfhg3gg7TRO .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-BDIanrfhg3gg7TRO .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-BDIanrfhg3gg7TRO .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-BDIanrfhg3gg7TRO :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}
下发
最高优先级
提交
次高优先级
本地调整
最低优先级
MDM 系统(Jamf/Intune/Kandji)
managed-settings.json/Library/Application Support/Claude/
Claude Code 实例
项目管理员
.claude/settings.json项目级配置
开发者
.claude/settings.local.json本地覆盖 (gitignore)
- managed-settings.json 通过 MDM 统一下发，开发者无法覆盖
- settings.json 提交到 Git，团队共享项目级规则
- settings.local.json 加入 .gitignore，允许开发者本地个性化
8. 总结
Claude Code 的 Tool System 与 Permission 机制构成了一套分层、可扩展、企业就绪的安全执行框架：
用户意图
↓
Agent 推理 → 选择工具
↓
Hook (PreToolUse) → 自定义拦截/改写
↓
PermissionChecker → managed > user > local 规则链
↓
Sandbox → 网络/文件系统隔离 (仅 BashTool)
↓
系统执行
↓
Hook (PostToolUse) → 结果处理/日志
对于 AI Agent 前端架构师而言，核心落地路径是：
