diff --git a/.gitignore b/.gitignore
index 5aee0f7..f5ea9c0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,9 @@
 # Claude Code worktrees. These are other sessions' checkouts living inside this
 # repo; `git add -A` will otherwise commit them as embedded git repositories.
 .claude/worktrees/
+
+# Per-operator Claude Code settings — local permission grants, not team config.
+# Untracked but not ignored meant one `git add -A` would publish one operator's
+# allowlist (including which secrets they may decrypt) to everyone.
+# `.claude/settings.json` IS tracked and stays the shared, reviewed config.
+.claude/settings.local.json