From d486c1c7c82ddd073225b28f639693df4af7aaea Mon Sep 17 00:00:00 2001
From: Shane Bishop <71288697+shanebishop1@users.noreply.github.com>
Date: Mon, 5 Jan 2026 21:10:50 -0800
Subject: [PATCH] docs: fix order of permissions in agents docs (permissions
 subsection) (#7041)

---
 packages/web/src/content/docs/agents.mdx | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/web/src/content/docs/agents.mdx b/packages/web/src/content/docs/agents.mdx
index c6e919e407..f3f0b52eb1 100644
--- a/packages/web/src/content/docs/agents.mdx
+++ b/packages/web/src/content/docs/agents.mdx
@@ -426,9 +426,9 @@ mode: subagent
 permission:
   edit: deny
   bash:
+    "*": ask
     "git diff": allow
     "git log*": allow
-    "*": ask
   webfetch: deny
 ---
 
@@ -470,7 +470,7 @@ This can take a glob pattern.
 ```
 
 And you can also use the `*` wildcard to manage permissions for all commands.
-Where the specific rule can override the `*` wildcard.
+Since the last matching rule takes precedence, put the `*` wildcard first and specific rules after.
 
 ```json title="opencode.json" {8}
 {
@@ -479,8 +479,8 @@ Where the specific rule can override the `*` wildcard.
     "build": {
       "permission": {
         "bash": {
-          "git status": "allow",
-          "*": "ask"
+          "*": "ask",
+          "git status": "allow"
         }
       }
     }