Permission Modes: Control Approval Frequency

The six permission modes

Claude Code supports six distinct permission modes. Each makes a different tradeoff between convenience and oversight by controlling what actions Claude Code can execute without prompting you. The mode you pick determines the baseline; you can layer permission rules on top to pre-approve specific commands or deny others.

Exact behavior by mode

| Mode | Label in CLI/UI | What runs without asking | Best for | |:---|:---|:---|:---| | default | Manual | Reads only | Sensitive work, getting started | | acceptEdits | Edit automatically | File edits + common filesystem commands (mkdir, touch, mv, cp, rm, rmdir, sed) | Iterating on code you're reviewing | | plan | Plan | Reads only (exploration); no edits until approved | Exploring a codebase before changing it | | auto | Auto | Everything, with background classifier checks | Long tasks, reducing fatigue | | dontAsk | Don't ask | Only pre-approved tools in permissions.allow rules | CI pipelines, locked-down scripts | | bypassPermissions | Bypass permissions | Everything including protected paths | Isolated containers and VMs only |

The mode names in code are lowercase and sometimes differ from their UI labels. The CLI and all file-based configuration use default, acceptEdits, plan, auto, dontAsk, and bypassPermissions. The alias manual is also accepted everywhere and maps to default; this requires Claude Code v2.1.200 or later.

Protected paths: always require approval

In all modes except bypassPermissions, writes to a small set of protected directories and files are never auto-approved, regardless of your permission mode. These paths guard repository state and Claude Code's own configuration:

Protected directories:

• .git, .config/git, .vscode, .idea, .husky, .cargo, .devcontainer, .yarn, .mvn, .claude (except .claude/worktrees)

Protected files:

• .gitconfig, .gitmodules, shell config files (.bashrc, .zshrc, etc.), package manager config (.npmrc, .yarnrc*, etc.), build tool configs (.bazelrc, gradle-wrapper.properties), pre-commit hooks (.pre-commit-config.yaml, lefthook.yml), and MCP/plugin configs (.mcp.json, .claude.json)

In default and acceptEdits mode, writes to protected paths prompt you. In auto mode, they route to the classifier. In dontAsk mode, they're denied. Only in bypassPermissions mode are they auto-approved.

When you approve a protected-path write with "Yes, and allow Claude to edit its own settings for this session," that approval lasts for the rest of the session without re-prompting.

Switching modes and setting defaults

Switch mid-session

In the CLI, press Shift+Tab to cycle through enabled modes. The cycle goes:

default → acceptEdits → plan → [bypassPermissions if enabled] → [auto if available] → (back to default)

Not every mode appears in the cycle. Auto mode appears only when your account meets all auto mode requirements. Bypass permissions appears only after you start with the flag or set it in settings. Don't ask never cycles; you set it explicitly.

The status bar shows which mode is active. Before v2.1.203, default mode showed no badge; v2.1.203 and later show ⏸ manual mode on in gray.

Set at startup

Pass the mode as a flag:

claude --permission-mode plan
claude --permission-mode acceptEdits
claude --permission-mode auto

The non-interactive -p flag works with --permission-mode too.

Set as a persistent default

Edit your ~/.claude/settings.json:

{
  "permissions": {
    "defaultMode": "acceptEdits"
  }
}

You can also set this in .claude/settings.json at your project root (applies to that project only) or in managed settings (applies organization-wide).

Valid values: default, manual (alias for default), acceptEdits, plan, auto, dontAsk, bypassPermissions.

Auto mode availability

Auto mode is available when:

• Your plan supports it (all plans as of v2.1.207)
• Your organization's Owner has enabled it (Team/Enterprise only; Individual plans have it by default)
• Your model is Claude Opus 4.6+, Claude Sonnet 4.6+, or Fable 5 on the Anthropic API; Claude Sonnet 5, Opus 4.7, Opus 4.8, or Fable 5 on Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry, or Claude apps gateway
• You've accepted the workspace trust dialog if running in an untrusted directory

If auto mode doesn't appear in your Shift+Tab cycle, at least one requirement is unmet. If a message says the classifier "cannot determine the safety" of an action, that's a transient outage, not a permanent restriction.

Mode deep dive: acceptEdits

acceptEdits mode auto-approves file edits and a fixed set of filesystem Bash commands. This is the most-used mode after default. Use it when you're iterating on code and want to review changes in your editor afterwards rather than approving each edit inline.

The auto-approved Bash commands are: mkdir, touch, rm, rmdir, mv, cp, and sed. These also work when prefixed with safe environment variables (LANG=C, NO_COLOR=1) or process wrappers (timeout, nice, nohup).

Important scope rule: auto-approval applies only to paths inside your working directory or in additionalDirectories that you've configured. Paths outside that scope, writes to protected paths, and all other Bash commands still prompt.

Example settings to enable:

{
  "permissions": {
    "defaultMode": "acceptEdits"
  }
}

Mode deep dive: plan

Plan mode tells Claude to read your codebase and propose changes without editing. Claude explores with read-only commands and writes a plan. Until you approve it, no edits happen.

In plan mode, Claude can:

• Read files (no prompt)
• Run shell commands in the built-in read-only set: ls, cat, grep, git log, head, tail, find, stat, which, diff, wc, and similar
• Write a plan as a message

Claude cannot:

• Edit files
• Delete files
• Run state-changing commands like rm, touch, git commit, npm install

Once Claude finishes the plan, it presents four options:

1. Yes, and use auto mode — Approve the plan and switch to auto mode (or acceptEdits if auto mode is unavailable)
2. Yes, manually approve edits — Approve and review each edit individually in manual mode
3. No, refine with Ultraplan — Send the plan to Ultraplan on claude.ai for browser-based review
4. No, keep planning — Stay in plan mode and request changes to the plan

You can press Ctrl+G to open the plan in your editor and make changes before Claude proceeds.

Plan mode is useful for:

• Exploring large codebases before committing to changes
• Reviewing proposed changes in detail before execution
• Checking that Claude's understanding of your code is correct

Set it as default:

{
  "permissions": {
    "defaultMode": "plan"
  }
}

Mode deep dive: auto

Auto mode lets Claude execute without routine permission prompts. A background classifier reviews each action and blocks anything that's irreversible, destructive, or targets outside your environment. Explicit ask rules still force a prompt.

The classifier trusts your working directory and the remotes configured for it at session start. Everything else is external unless you configure trusted infrastructure. Actions like pushing to a new remote, downloading and executing code, or writing to unfamiliar cloud buckets are blocked by the classifier.

Removals targeting / or your home directory (e.g., rm -rf ~) always prompt as a circuit breaker against model error, even in auto mode. The same applies to removals containing command substitution ($(...) or backticks) or process substitution (<(...)).

Auto mode nudges Claude to work without stopping for clarifying questions. But if your prompt or a skill explicitly relies on a question, Claude still asks.

Set it at startup:

claude --permission-mode auto

Or default:

{
  "permissions": {
    "defaultMode": "auto"
  }
}

Mode deep dive: dontAsk

dontAsk mode auto-denies every tool that would normally prompt you. Claude runs only:

• Actions matching permissions.allow rules
• Built-in read-only Bash commands
• Actions approved by PreToolUse hooks

Any other tool is denied silently. Claude doesn't ask; it just doesn't call the tool.

Use this mode for CI pipelines, background tasks, or restricted environments where you pre-define exactly what Claude may do. The session never waits for input.

Explicit ask rules are treated as denials in this mode: Claude Code denies the call rather than prompting. Same for connector tools your organization set to ask and MCP tools marked requiresUserInteraction.

Set at startup:

claude --permission-mode dontAsk

This mode is useful for automation but not for interactive sessions.

Mode deep dive: bypassPermissions

bypassPermissions mode disables permission prompts and safety checks. Tool calls execute immediately. Only use this mode in isolated containers, VMs, or dev containers where Claude Code cannot damage your host system.

Explicit ask rules still force a prompt. Connector tools your organization required to ask still prompt. And root/home directory removals still prompt as a circuit breaker.

Enable it:

claude --dangerously-skip-permissions
# or
claude --permission-mode bypassPermissions

Or set as default (though this is strongly discouraged):

{
  "permissions": {
    "defaultMode": "bypassPermissions"
  }
}

The first time you start an interactive session with this mode, Claude Code shows a warning and asks you to accept responsibility. Claude Code saves your acceptance, so the dialog only appears once.

On Linux and macOS, Claude Code refuses to run this mode when you're root or using sudo. The check is skipped inside a recognized sandbox (like a dev container).

Stacking modes with permission rules

Permission modes set the baseline. Layer permission rules on top to be more restrictive:

• Deny rules block matching actions in every mode, including bypassPermissions
• Ask rules force a prompt in every mode, even auto and bypassPermissions, overriding the mode's default
• Allow rules pre-approve actions in modes that would normally prompt (like default), but have no effect in bypassPermissions

For example, if you're in auto mode but want to be asked before every git push, add an ask rule:

{
  "permissions": {
    "defaultMode": "auto",
    "ask": [
      "Bash(git push *)"
    ]
  }
}

The classifier won't auto-approve your push; you'll get a prompt even in auto mode.

Common mistake

Assuming acceptEdits mode is safer than default mode. It's not safer; it's faster. acceptEdits just auto-approves a fixed set of commands and file edits in your working directory. If you use it on untrusted code or in high-risk work, you're skipping approval for potentially dangerous edits. Use acceptEdits when you trust the direction and plan to review changes afterward (in your editor via git diff), not as a security measure. For sensitive work, stay in default mode and read each proposed change before approving.