Equation 5 · Part 4 · What Claude Code's Permission Model Actually Allows, in Plain Terms

Symbol W

\text{decision}(c) = \begin{cases} \text{deny}, & c \in D \\ \text{ask}, & c \notin D \text{ and } c \in A \\ \text{allow}, & c \notin D \cup A \text{ and } c \in W \\ \text{ask (default)}, & \text{otherwise} \end{cases}

W

What this part means

the allow set.

Its job in the formula

W is an input to the expression that computes the quantity on the left.

Full expressionSymbol WArticle meaning

Where the article explains it

For a tool call c checked against the deny set D , the ask set A , and the allow set W : $\text{decision}(c) = \begin{cases} \text{deny}, & c \in D \\ \text{ask}, & c \notin D \text{ and } c \in A \\ \text{allow}, & c \notin D \cup A \text{ and } c \in W \\ \text{ask (default)}, & \text{otherwise} \end{cases}$ .

The passage around this formula

The precedence is simple enough to state directly. For a tool call c checked against the deny set D , the ask set A , and the allow set W : $\text{decision}(c) = \begin{cases} \text{deny}, & c \in D \\ \text{ask}, & c \notin D \text{ and } c \in A \\ \text{allow}, & c \notin D \cup A \text{ and } c \in W \\ \text{ask (default)}, & \text{otherwise} \end{cases}$ . An unmatched command does not fail open into silent execution. It falls through to a prompt — what the documentation calls fail-closed matching [ 2 ] .

Read this part in the article →

Learn the underlying idea

A variable is a named place for a value. Its letter is a local label: x can mean position in one formula and a data point in another.

Open the illustrated variables: a letter stands for a value guide →

See this notation across published equations →

Sources cited in the surrounding passage

[2] Security ↗

These citations provide research context; check each source for the exact claim it supports.