Open /permissions to see and edit your current rules. Each rule is tied to a tool name. The built-in tools are Bash, Edit, Write, Read, WebFetch, and a few others. A rule like "Allow Bash" lets Claude run any shell command without asking. "Deny Write" blocks all file creation.
Rules are evaluated in a fixed priority order: Deny rules always fire first, then Ask rules, then Allow rules. If you have "Allow Bash" and "Deny Bash(rm)", the Deny wins regardless of which one appears first in the list. I find the safest starting point is narrow Allow rules for the tools you use often, with everything else left at Ask. See the permissions docs for the full evaluation model.