Contents
The "Permission Mode" selector next to the prompt box in Claude Code — the one you cycle with Shift+Tab — decides how often Claude pauses to ask permission before it edits a file or runs a command. More confirmations means safer; fewer means Claude works in longer, uninterrupted stretches.
This guide covers what permission modes are, how the 6 modes differ, how to switch them, how auto mode works, and how to use them safely. You'll understand exactly what the five entries in the desktop app's selector — Manual / Accept edits / Plan / Auto / Bypass permissions — each mean (earlier versions labeled them Ask permissions / Accept edits / Plan mode / Auto mode / Bypass permissions).
Switch how often Claude asks
More oversight (safer) ⟷ more autonomy (uninterrupted)
1. What permission modes are
When Claude wants to edit a file, run a shell command, or make a network request, how often should it stop and ask you to approve the action? Permission modes control exactly that. In the strictest one, Manual (config value default), Claude pauses before each of those actions and asks first (source: Claude Code's official "Choose a permission mode").
Stricter modes review each action as it comes (safer, more prompts). Looser modes let Claude work in long uninterrupted stretches and report back when done (faster, fewer prompts). The trick is to pick more oversight for sensitive work, fewer interruptions when you trust the direction.
The mode a session starts in depends on how you run Claude Code and on its version. With v2.1.283 or later, interactive sessions you start in a terminal or through VS Code start in Auto (auto mode) on every plan and provider (including Enterprise plans, Claude Console API keys, and Amazon Bedrock; as of October 5, 2026). Before v2.1.283, only Pro, Max, and Team plans started in Auto, and everything else started in Manual. claude -p, the Agent SDK, and sessions where any settings file sets disableAutoMode to "disable" start in Manual, as do sessions that don't meet auto mode's requirements (§4). The first session right after an install or upgrade can start in a different mode. A startup flag or a defaultMode in your settings file takes precedence.
🛡️ Protected paths are special: writes to a small set of critical paths (.git, .claude, shell config files, etc.) are never auto-approved outside Bypass permissions: Manual and Accept edits prompt, Auto sends them to the classifier, and dontAsk denies them (the only other exception is Plan in a terminal session started with bypass available). It's a safety net against corrupting repo state or Claude's own config.
2. The 6 modes (dontAsk isn't in the switcher)
The desktop app's selector lists five (Manual / Accept edits / Plan / Auto / Bypass permissions); Auto and Bypass permissions appear only when their conditions are met. Add dontAsk, which never appears in the cycle and is set with a launch flag or in settings, and you have the six modes in the official documentation. Each differs in what runs without asking.
Asks for anything beyond reads
Reads auto-approved; file edits and commands prompt each time. For sensitive work or when you want to see every action. The starting mode for claude -p, the Agent SDK, and setups where Auto is turned off or unavailable.
Auto-approves edits in your working dir
Auto-approves file edits plus common filesystem commands (mkdir/touch/rm/rmdir/mv/cp/sed) inside your working dir. Out-of-scope paths, protected paths, removals of critical paths, and other commands still prompt. For reviewing changes via git diff afterward.
Plans without editing
Reads and explores but does not edit your source. Where Auto is available, the classifier reviews its exploration commands and lets approved ones run. Proposes a plan first; approving it switches to the mode you pick. For understanding a codebase before changing it.
Near-zero prompts with safety checks
Better known as auto mode. A separate classifier model blocks dangerous actions while everything else runs without prompting. Cuts prompt fatigue on long tasks. The starting mode in the terminal and VS Code (on every plan with v2.1.283 or later; before that, only on Pro, Max, and Team). Has requirements (see §4).
Nearly everything, no checks (dangerous)
Prompts and safety checks disabled (a few things, such as ask rules and removals of critical paths, still prompt). In the desktop app and VS Code, removals of critical paths are denied without a prompt (v2.1.309 and later). Isolated containers/VMs only. No protection against prompt injection. See bypass mode security.
Only pre-approved tools run
A 6th mode that never appears in the Shift+Tab cycle. Runs only what needs no approval (reads in your working dirs, read-only commands) and what your allow rules pre-approve; anything that would prompt is auto-denied. For CI and locked-down environments.
What the desktop app's menu shows (as of October 5, 2026)
In the desktop app's Code tab, open the selector next to the send button and the modes appear in the order below. The description under each name is exactly what the screen shows, and Auto carries a "Recommended" badge (checked on the author's Windows app, as of October 5, 2026).
| Display name | Menu description (as shown) | Setting value |
|---|---|---|
| Auto (Recommended) | Claude handles permission decisions | auto |
| Manual | Always ask before making changes | default |
| Accept edits | Automatically accept all file edits | acceptEdits |
| Plan | Create a plan before making changes | plan |
| Bypass permissions | Accepts all permissions | bypassPermissions |
- The mode you pick is remembered per folder: the next session you start in that folder uses the same mode, and it takes precedence over
defaultModein your settings file. Plan is the exception and lasts only for the current session (official docs: "Desktop application"). - Bypass permissions appears only after you allow it in settings: on Pro and Max, turn on "Allow bypass permissions mode" under Settings → Claude Code. Team and Enterprise have no such toggle; your organization's policy decides. It's unavailable when Claude Code runs as root.
- Auto appears only when you meet its requirements (§4). There's no separate on/off switch for it in settings.
- dontAsk can't be selected in the desktop app (CLI only).
- The older English Code tab called the modes Ask permissions / Auto accept edits / Plan mode.
3. How to switch (Shift+Tab and more)
In the terminal (CLI), the quickest way is Shift+Tab. During a session it cycles Manual → Accept edits → Plan; if you're in Auto, the first press takes you to Manual (the status bar shows the current mode, e.g. ⏸ manual mode on). In VS Code, click the mode indicator at the bottom of the prompt box; in the desktop app, use the mode selector next to the send button; on claude.ai, use the dropdown next to the prompt box.
Auto and Bypass permissions join the cycle conditionally, slotting in after Plan in the order Bypass permissions → Auto. Auto appears when you meet its requirements, and switching to it asks for no confirmation. Bypass permissions is only available when you start with --permission-mode bypassPermissions, --dangerously-skip-permissions, or --allow-dangerously-skip-permissions (which adds it to the cycle without turning it on), or when defaultMode is bypassPermissions in user or managed settings. dontAsk never appears in the cycle — set it with --permission-mode dontAsk or in settings.
In Manual and Accept edits, a Bash command's permission prompt may offer "Yes, and switch to auto mode". Picking it approves the command and switches the session to Auto (only where Auto is available).
# Set the mode at startup
claude --permission-mode plan
claude --permission-mode acceptEdits
# Bypass needs its dedicated flag (isolated environments only)
claude --dangerously-skip-permissionsTo always start in the same mode, set a default in your settings file.
// .claude/settings.json
{
"permissions": {
"defaultMode": "acceptEdits"
}
}* The defaultMode values auto and bypassPermissions don't take effect from project settings (.claude/settings.json, .claude/settings.local.json). With auto there, the session starts in the built-in default (your user-level defaultMode isn't used either); with bypassPermissions, it starts in Manual. Put these two in user settings (~/.claude/settings.json) or your organization's managed settings. The VS Code extension doesn't read project settings for the starting mode at all — use its claudeCode.initialPermissionMode setting.
4. Auto mode in depth
Auto mode removes almost all confirmation prompts — but it isn't a free-for-all. Before each action, a separate classifier model reviews it and blocks anything that escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read.
⚠️ Don't over-trust it: the official docs warn that auto mode reduces prompts but does not guarantee safety. Use it where you trust the general direction, not as a replacement for review on sensitive operations.
Requirements: every plan qualifies. On Team and Enterprise it's available by default, but admins can turn it off organization-wide by setting permissions.disableAutoMode to "disable" in managed settings. On the Anthropic API and Claude Platform on AWS the model must be Opus 4.6 or later, Sonnet 4.6 or later, or a Fable model; on Amazon Bedrock, Google Cloud, Microsoft Foundry, and signed-in Claude apps gateway sessions only Sonnet 5 or later, Opus 4.7 or later, and Fable models are supported (Sonnet 4.5, Opus 4.5, Haiku, etc. aren't supported anywhere). If it reports "unavailable," check these requirements first, then whether any settings file sets disableAutoMode. Anthropic may also have switched it off server-side; that lasts until the session ends, so start a new session later.
✅ Allowed by default
File operations in your working dir, installing dependencies declared in lock files or manifests, reading .env and sending credentials to their matching API, read-only HTTP, and pushing to any branch of the repo you're working in (including the default branch; branches named as deploy targets, like production or gh-pages, are judged separately).
⛔ Blocked by default
curl | bash, sending sensitive data to external endpoints, production deploys/migrations, granting IAM or repo permissions, force-push, discarding uncommitted changes with git reset --hard and the like, terraform destroy, and more.
Boundaries you state in conversation (e.g. "don't push," "don't deploy until I review") are treated as a block signal too. But these aren't saved as rules — the classifier re-reads them from the transcript each time, so a boundary can be lost if context compaction removes the message. For a hard guarantee, add a deny rule. Where modes set the baseline for how often Claude asks, Claude Code's permission rules (allow/ask/deny) give you finer, per-tool control. If the classifier blocks 3 actions in a row or 20 in total, auto mode pauses and Claude Code goes back to prompting; approving the prompted action resumes auto mode (these thresholds aren't configurable).
When a legitimate action gets blocked (a false positive), open /permissions, go to the Recently blocked tab (Recently denied before v2.1.314), select the action and press r to let Claude retry it. For a destination Claude needs throughout the task, such as a package registry or an internal domain, add it to autoMode.environment; for a command you want to run without review from now on, add an allow rule; for a one-off, state your intent in your next message and let Claude retry. A message saying is temporarily unavailable (for example with (timed out)) means the classifier couldn’t return a verdict, which is different from a judged denial. It doesn’t appear under Recently blocked, so wait a few seconds and retry (if (timed out) keeps repeating, check your connection); you don’t need to change settings. You can report false positives with /feedback (official docs: Configure auto mode and Error reference, as of September 29, 2026). In late September 2026, several GitHub issues reported work stalling because of classifier false positives or timeouts (e.g. #95996, #96077, #96662).
A stop that shows <model>'s safeguards flagged this message is not the auto mode classifier at work: it comes from the model's own safety classifiers reacting to the conversation, which is separate from permission modes (for what to do, see safeguards flagged this message: What It Means and What to Do).
5. Which mode when, and safety
Choose by the oversight-vs-autonomy tradeoff. Quick reference:
| Mode (display) | When to use it |
|---|---|
| Manual (default) | Getting started / sensitive work. When you want to approve each action |
| Accept edits (acceptEdits) | Iterating on code you review; check the diff afterward |
| Plan (plan) | Understanding a codebase and settling on a design before changing it |
| Auto (auto) | Long tasks where you trust the direction; cutting prompt fatigue |
| Bypass permissions (bypass) | Isolated containers/VMs only, where Claude can't damage your host |
| dontAsk | CI / locked-down environments where you pre-define what Claude may do |
⚠️ Don't reach for Bypass permissions casually: it offers no protection against prompt injection or unintended actions. The answer to "prompts are annoying" is auto mode (with background safety checks), not bypass. Note that hooks still run in bypass mode and can block dangerous operations. For why bypass sometimes still asks, see the security guide and this article.
* Mode names and behavior are per Claude Code's official docs (Choose a permission mode); the display names follow the desktop app's UI (as of October 5, 2026; checked on screen and in claude.ai's translation data). Requirements and behavior can change — check the official docs and your app for the latest.
Note that in cloud sessions (claude.ai/code), the same mode names behave differently. In the cloud, file edits are allowed in every mode, so Accept edits is effectively the normal mode and stops for every command, such as npm install or a build. To keep going without approvals, choose Auto. I wrote up a real case where I got stuck in Setting Up Claude Code Cloud Sessions Securely: A Setup That Protects Production, and 5 Places I Got Stuck.
6. Relation to effort, and common mix-ups
Next to the prompt box sit two big selectors: "Permission Mode" and "Effort". They do different jobs.
Permission mode = "how much it asks"
The safety-vs-autonomy tradeoff. How often Claude pauses to ask permission.
Effort = "how hard it thinks"
The speed-vs-smarts tradeoff. How much thinking and how many tokens go into a reply (details).
They connect, too. When you approve a plan, you choose whether to continue in Auto or approve each edit manually (where Auto isn't available, that option auto-accepts edits instead). And pairing "Ultracode" from the effort settings (since v2.1.284 not an effort step but a switch you can turn on at any level) with Auto removes the workflow-execution prompt entirely, even the first time, so Claude can run end to end (Auto alone asks only on the first launch). There is also a setting that plans on Opus only while you are in plan mode and hands the approved implementation to Sonnet (What Is Claude Code's opusplan?).
The common mix-up is "prompts are annoying, so I'll use bypass." That's risky — the right answer is auto mode (with background checks). Another: "Plan is safe, so anything goes." Plan only means "no source edits"; its exploration commands still run. Where Auto is available, commands the classifier approves run without a prompt; elsewhere, anything beyond read-only commands prompts. And in a terminal session started with bypass available, edits and commands Claude attempts during planning go through without a prompt.
Summary
Three takeaways on Claude Code permission modes.
- What it is: the setting for how often Claude asks permission before editing or running commands. Switch with
Shift+Tabor the selector. - The modes: Manual (default) / Accept edits (acceptEdits) / Plan (plan) / Auto (auto) / Bypass permissions (bypass), plus dontAsk, set by flag or in settings (six in all). The terminal and VS Code start in Auto (on every plan with v2.1.283 or later; before that, only on Pro, Max, and Team). Protected paths are never auto-approved outside bypass.
- Which when: default for sensitive work, acceptEdits for iterating, plan to understand first, auto for long tasks (with background checks), bypass only in isolated environments.
Permission mode governs "safety," effort governs "smarts" — master both and Claude Code runs safely and smoothly. Pair it with hooks to add your own safety rules, and with the sandbox, which fences what commands can touch at the OS level, to cut prompts while staying safe.
FAQ
Q. Prompts are annoying. Which mode should I use?
A. With v2.1.283 or later, the terminal and VS Code already start in Auto (auto) on every plan, so prompts should be rare. If you start in Manual, begin with Accept edits (acceptEdits) to auto-approve edits in your working dir; to cut prompts further, switch to Auto — near-zero prompts with background safety checks. Don't use Bypass permissions outside an isolated environment.
Q. How is Auto (auto mode) different from Bypass permissions?
A. Auto mode has a separate classifier model block dangerous actions while running everything else without prompts. Bypass permissions disables safety checks and runs nearly everything, so it's for isolated containers/VMs only. For everyday use, choose Auto, not bypass.
Q. Why can't I select Auto (auto mode)?
A. Check the model first: on the Anthropic API it must be Opus 4.6 or later, Sonnet 4.6 or later, or a Fable model; on Bedrock and similar providers only Sonnet 5 or later, Opus 4.7 or later, and Fable models work (Sonnet 4.5, Haiku, etc. are not supported). Next, check whether an admin or any settings file has turned it off with disableAutoMode. If Anthropic has switched it off server-side, start a new session later. Once eligible, it appears in the selector and the Shift+Tab cycle.
Q. What exactly is "safe" about plan mode?
A. It doesn't edit your source. It reads, explores, and proposes a plan; approving the plan switches to the mode you pick and execution begins. Use it to settle on an approach before making changes. One caveat: in a terminal session started with bypass available, plan mode doesn't stop edits.
Q. Can I start in a specific mode?
A. Yes. Pass a startup flag like claude --permission-mode plan, or set permissions.defaultMode in your settings file. Note that auto and bypassPermissions only take effect from user settings (~/.claude) or your organization's managed settings, not project settings.
