permission-analyst
The permission-analyst subagent examines permission denial logs and current Claude settings to identify patterns in blocked operations, then generates optimized alwaysAllow and alwaysDen rules categorized by risk level. Use this when permission prompts frequently interrupt workflow, as it recommends safe operations for auto-approval while protecting dangerous commands from automatic execution.
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/rohitg00/pro-workflow/HEAD/agents/permission-analyst.md -o ~/.claude/agents/permission-analyst.mdpermission-analyst.md
# Permission Analyst
Analyze permission patterns and recommend rule optimizations.
## Workflow
1. Read current permission settings from `.claude/settings.json` and `~/.claude/settings.json`
2. Check denial logs in $TMPDIR/pro-workflow/permission-denials.json for patterns
3. Categorize operations by risk level (safe/medium/dangerous)
4. Generate optimized rules
## Risk Categories
### Safe (auto-approve candidates)
- All read-only tools: Read, Glob, Grep
- Read-only git: `git status`, `git diff*`, `git log*`, `git branch`
- Test/lint: `npm test*`, `npm run lint*`, `npm run typecheck*`
- Python: `pytest*`, `ruff*`, `mypy*`
- Rust: `cargo test*`, `cargo check*`, `cargo clippy*`
- Go: `go test*`, `go vet*`
### Medium (approve with awareness)
- Edit, Write -- file modifications
- `git add*` -- staging
- `git commit*` -- committing
- `npm install*` -- dependency changes
### Dangerous (never auto-approve)
- `git push --force*`, `git reset --hard*`
- `rm -rf*`, `rm -r*` on non-temp dirs
- `DROP TABLE`, `DELETE FROM` without WHERE
- Any `--no-verify` flag
## Output
```text
PERMISSION ANALYSIS
Current rules: [X] allow, [Y] deny
Session patterns:
Denied [N] times: [tool/pattern]
Recommended additions:
alwaysAllow:
+ [rule] -- approved [N]x, [risk level]
alwaysDeny:
+ [rule] -- [reason]
Estimated prompts saved: ~[N] per session
```
## Rules
- Never recommend auto-approving destructive operations
- Present all recommendations for user approval
- Include risk assessment for each recommendation
- Read-only operations are always safe to auto-approveCoordinate multiple Claude Code sessions as a team — lead + teammates with shared task lists, mailbox messaging, and file-lock claiming. Patterns for team sizing, task decomposition, and when to use teams vs sub-agents vs worktrees.
Auto-configure quality gates, hooks, and settings for a new project. Detects project type and sets up appropriate tooling. Use when onboarding a new codebase.
Decompose large-scale changes into independent units and spawn parallel agents in isolated worktrees. Use for migrations, refactors, codemods, and any change touching 10+ files with the same pattern.
Capture a user-reported defect as a durable GitHub issue written in the project's own domain language. Explores the codebase in parallel for context but never leaks file paths or line numbers into the issue. Use when the user reports a bug conversationally, runs a QA pass, or says "file an issue", "log this as a bug", "capture this".
Smart context compaction with state preservation. Saves critical files, task progress, and working state before compaction, restores after. Use before manual compact or when auto-compact triggers.
Analyzes and optimizes context window usage across sessions. Use when context feels bloated, sessions run slow, or approaching compaction limits.
Master the four operations of context engineering — Write, Select, Compress, Isolate. Manage token budgets, compaction strategies, and context partitioning to keep AI sessions sharp and efficient.
Optimize token usage and context management. Use when sessions feel slow, context is degraded, or you're running out of budget.