In Claude Code, I want a Skill to write a full document to a fixed file path without triggering an interactive permission prompt. The path comes from an env var `AI_CONTROL_PANEL` (e.g. `/Users/x/.config/ai-control/panels/proj.md` on macOS, `/home/x/...` on Linux) and is OUTSIDE the current project working directory.

I control the pool's user-scope settings file (CLAUDE_CONFIG_DIR/settings.json) and the project's `.claude/settings.json`, both of which use the `permissions.allow` array format (e.g. entries like `Edit(~/proj/**)`, `additionalDirectories`).

Questions, answer precisely with exact syntax:

1. What is the exact `permissions.allow` entry that reliably pre-approves the write, for each of these two write methods:
   (a) A Bash heredoc that redirects to the file: `cat > "$AI_CONTROL_PANEL" <<'EOF' ... EOF` (or `tee "$AI_CONTROL_PANEL" > /dev/null <<'EOF'`).
   (b) The built-in Write tool writing to the resolved absolute path.

2. For Bash: does Claude Code's allow-matching operate on the command's leading token/prefix (so `Bash(cat:*)` or `Bash(tee:*)` works), and does an output redirection (`>`) or pipe cause a SEPARATE approval that the rule can't cover? Is there a rule form that covers the redirect target?

3. For the Write tool: what path-glob syntax does a `Write(...)` allow-rule accept — absolute path globs only, or does `~` expand? Does Write to an already-existing file require a prior Read (which would itself prompt or add friction)?

4. Which of (a)/(b) is the more robust, single-rule way to make this write silent across macOS and Linux? Give the concrete recommended rule string(s) and the exact settings.json snippet.

Be concrete and current. If behavior differs by Claude Code version, note it.


I need to fetch the official Claude Code documentation to give you exact syntax and current behavior. Let me check the permissions system documentation.


WebFetch

Prompt: permissions allow list settings syntax Bash Write tool