When approving actions "for this project" I actively monitor .claude\settings.local.json as "Bash(az resource:)", is much more permissive than "Bash(az reso

When approving actions "for this project" I actively monitor .claude\settings.local.json as "Bash(az resource:)", is much more permissive than "Bash(az resource show:)", It mostly gets it right but I instantly fix the file with the "readonly" version when it gets it too open.