Designing a Permission Rule for Destructive Git Operations

Your team's .claude/settings.json currently has:

{
  "permissions": {
    "allow": [
      "Bash(git *)"
    ]
  }
}

because a teammate got tired of approving git status and git diff calls one at a time.

1. What's specifically wrong with this rule, given the reversibility principle from earlier in the track?
2. Rewrite the permissions block to keep the convenience (no prompts for routine, read-only, or ordinary commit operations) while closing the gap. Be specific about which subcommands you allow and which you explicitly deny.
3. Why is an explicit deny rule for git push --force * a stronger guarantee than simply leaving it out of the allow list?