Overview
Claude Code, one of today’s most popular AI coding assistants, makes its permission system central to the design. Whenever Claude wants to edit a file, run a shell command, or make a network request, it pauses and asks for your approval. Permission modes control how often that pause happens.
Claude Code offers six permission modes, each making a different tradeoff between convenience and safety. This guide walks through every mode’s behavior, best-fit scenarios, commands, and practices, so you can choose well in daily work.
The Modes at a Glance
The six modes, ordered from most restrictive to most permissive:
| Mode | Runs without approval | Best for |
|---|---|---|
default | Read-only operations | First use; sensitive projects |
acceptEdits | Reads, file edits, common filesystem commands | Iterating on existing code |
plan | Read-only | Exploring a codebase; analyze before modifying |
auto | Everything (with background safety checks) | Long-running tasks; approval fatigue |
dontAsk | Only pre-approved tools | Locked-down CI and script environments |
bypassPermissions | Everything | Isolated containers or VMs only |
In every mode except bypassPermissions, writes to protected paths are never auto-approved — preserving the safety of your repository state and Claude’s own configuration.
1. Default Mode
Default is what Claude Code starts in, and it is the baseline of permission control. Claude may perform read operations without approval — reading files, searching the codebase, analyzing structure. Every state-changing action — editing files, executing shell commands, making network requests — pauses and requires your explicit approval.
Use when: you’re new to Claude Code and learning its behavior; the repo is sensitive or high-risk; you want full control of every step.
# launch in default mode
claude
# switch modes in-session (Shift+Tab cycles)
# cycle order: default → acceptEdits → planBest practice: Default is the safe starting point. If approval volume slows you down, step up to acceptEdits; for production systems or sensitive data, stay here.
2. AcceptEdits Mode
AcceptEdits loosens default by one notch: Claude can create and edit files in the working directory without per-file approval. The status bar shows ⏵⏵ accept edits on when active. Beyond file edits, it auto-approaches common filesystem commands — mkdir, touch, rm, rmdir, mv, cp, and sed — even when prefixed with safe environment variables (like LANG=C or NO_COLOR=1) or process wrappers (like timeout, nice, nohup). Auto-approval applies only within the working directory or additionalDirectories; writes outside that scope, protected-path writes, and all other shell commands still require approval.
Use when: reviewing and iterating on existing code; you prefer auditing changes afterward via git diff or the editor; routine refactoring and feature work.
# launch in acceptEdits mode
claude --permission-mode acceptEdits
# switch to it in-session with Shift+Tab
# set it as the default — .claude/settings.json
{
"permissions": {
"defaultMode": "acceptEdits"
}
}Best practice: this is the recommended daily mode for most developers — no confirm-clicking every file edit, while critical operations (network requests, database writes, deploys) still need your sign-off. In the VS Code extension, set claudeCode.initialPermissionMode to acceptEdits.
3. Plan Mode
Plan mode switches Claude Code into a “research only, modify nothing” workflow. Claude can read files and run shell commands to explore, and it produces a detailed plan — but touches no source code. Approval rules match default mode.
The plan-approval flow: when the plan is ready, Claude presents it and asks how to proceed. You can approve and switch to auto for autonomous execution; approve and switch to acceptEdits for automatic editing; approve and review each change manually; keep giving feedback to refine the plan; or use Ultraplan to review it in the browser. You can also press Ctrl+G to open the plan in your default text editor, edit it directly, then let Claude execute.
Use when: exploring an unfamiliar codebase; you want a proposal before any modification; code review or security audits.
# launch in plan mode
claude --permission-mode plan
# one-shot plan for a single prompt
/plan analyze the performance bottlenecks in this module
# set as the project default
{
"permissions": {
"defaultMode": "plan"
}
}Best practice: before touching an unfamiliar codebase or starting a large refactor, run plan mode first. On legacy systems especially, it prevents the AI from making wrong edits based on an incomplete understanding of the structure.
4. Auto Mode
Auto, introduced in Claude Code v2.1.83, is the advanced permission mode: Claude executes freely without permission prompts, while an independent classifier model inspects each operation beforehand and blocks anything out of scope, aimed at unidentified infrastructure, or driven by malicious content.
Note: auto mode is a research preview. It reduces prompts but does not guarantee safety. Use it for tasks whose general direction you trust — not as a replacement for review of sensitive operations.
Availability requirements: a Max, Team, Enterprise, or API plan (not Pro); admin enablement for Team and Enterprise; Claude Sonnet 4.6, Opus 4.6, or Opus 4.7 models; and the Anthropic API only (Bedrock, Vertex, and Foundry are excluded).What the classifier blocks by default: downloading and executing code (like curl | bash); sending sensitive data to external endpoints; production deploys and database migrations; bulk deletions on cloud storage; granting IAM or repository permissions; modifying shared infrastructure; irreversibly destroying files that existed before the session; and force-pushing or pushing directly to main. What it allows by default: local file operations inside the working directory; installing dependencies declared in lockfiles or manifests; reading .env and sending credentials to the matching API; read-only HTTP requests; and pushing to branches you started or Claude created.
# enter auto mode via the Shift+Tab cycle
# view the default auto-mode rules
claude auto-mode defaultsThe safety throttle: if the classifier blocks 3 consecutive or 20 cumulative operations, auto mode pauses itself and reverts to prompting. Manually approving a blocked operation restores auto. The thresholds are not configurable.Best practice: auto suits long-running automation (batch refactors, large-scale test generation), ideally paired with admin-configured trusted infrastructure to narrow the boundary further.
5. DontAsk Mode
DontAsk looks like auto — fewer prompts! — but works completely differently. It denies every tool call that is not explicitly pre-approved; only operations permitted through permissions.allow rules or the /permissions command can execute. This is a whitelist model: deny everything first, then open doors one by one.
Use when: CI/CD pipeline automation; tightly controlled production environments; any scenario demanding a precise set of AI-executable actions.
# launch dontAsk mode
claude --permission-mode dontAsk
# note: dontAsk is NOT in the Shift+Tab cycle —
# it must be set at launch via the flag{
"permissions": {
"defaultMode": "dontAsk",
"allow": [
"Read",
"Bash(cat *)",
"Edit(./src/**)"
],
"deny": [
"Bash(curl http://*)",
"Bash(rm -rf /)"
]
}
}Best practice: dontAsk is the first choice for CI/CD and automation scripts. With fine-grained allow/deny rules you can build a fully predictable AI behavior envelope, and combined with protected paths it keeps your repository and configuration intact.
6. BypassPermissions Mode
BypassPermissions sits at the top of the permission hierarchy: it bypasses the entire permission system, letting Claude do anything without approval. The flag name — --dangerously-skip-permissions — announces the risk by design.
Security warning: this mode skips all permission checks, including protected-path write protection. Use it only inside isolated containers or virtual machines.Enabling it: Shift+Tab cannot reach this mode; explicit launch authorization is required:
# enable directly (effective immediately)
claude --permission-mode bypassPermissions
# or
claude --dangerously-skip-permissions
# add it to the Shift+Tab cycle without activating
claude --allow-dangerously-skip-permissionsOnce set, bypassPermissions appears in the Shift+Tab cycle after plan and before auto. The VS Code extension also requires flipping “Allow dangerously skip permissions” in settings before it shows up.
Use when: Docker containers or VMs holding nothing important; large experiments in throwaway sandboxes; automated test scenarios (though pairing CI with dontAsk is more controllable). Best practice: the rule is simple — never use bypassPermissions on a host development environment. If you need an approval-free experience, prefer auto or a well-configured dontAsk. Treat bypass as the last resort, reserved for isolated environments with rollback snapshots.
The Protected-Path Mechanism
In every mode except bypassPermissions, Claude Code shields the following from automatic writes: the .claude/ directory (Claude’s configuration and state); the .git/ directory (repository metadata); the .env file (environment variables); and untracked files that existed at session start. These protections ensure that even in high-permission modes, Claude cannot accidentally wreck your repository infrastructure or configuration.
A Decision Guide for Choosing
- New to Claude Code →
default, to learn the approval flow - Daily coding iteration →
acceptEdits, skipping per-edit confirmations - Analyzing an unfamiliar codebase →
plan, proposal before action - Long batch tasks →
auto, with background safety checks - CI/CD automation →
dontAsk, with strict allow rules - Isolated sandbox →
bypassPermissions, with rollback ready
In any mode, you can fine-tune per-tool approval behavior through permissions.allow and permissions.deny rules in .claude/settings.json for truly granular control.
The Bottom Line
Claude Code’s six permission modes form a complete spectrum from strict to free: default’s per-action approval, acceptEdits’ file-edit trust, plan’s analysis-first workflow, auto’s intelligent safety classifier, dontAsk’s whitelist control, and bypassPermissions’ total freedom. Understanding each mode’s boundaries and best fits lets you find the right balance of safety and efficiency. For most developers: acceptEdits for daily work, plan mode before complex tasks, bypassPermissions only where an isolated environment makes it safe.
Tags: Claude Code, AI coding, permission management, developer tools, Anthropic, 2026
