All 6 Claude Code permission modes, and what each one allows

What is a permission mode?

A permission mode is the baseline for what Claude Code can do without stopping to ask you.

It is not a setting you configure once and forget. You switch it during a session as the work changes: careful while you are reviewing, looser while you are iterating, locked down when something else is running it.

Modes set the baseline. Permission rules layer on top to pre-approve or block specific tools, and a deny rule blocks in every mode, including the one that skips all checks.

The 6 modes

The name you see and the name a settings file wants are not the same, so both are below. The label is what the mode picker shows you, and the value in backticks is what you type into a config or a flag.

Manual, config value default, lets Claude read without asking, and everything else asks first. It is the right mode for anything sensitive.

Accept edits, acceptEdits, also lets through file edits and common filesystem commands like mkdir, touch, mv and cp. Use it for iterating on work you are watching. The VS Code extension is the one place that labels this Edit automatically, and it is the same mode.

Plan, plan, allows reads, plus classifier-approved commands where auto mode is available. Use it to let Claude look around before it changes anything.

Auto, auto, lets everything through with background safety checks. This is the one the 3-mode guides miss, and it is what you want for a long task rather than turning safety off entirely. On a current version, a session you start in the terminal or VS Code begins here.

Don't ask, dontAsk, allows only pre-approved tools and denies everything else automatically. It is not in any mode picker, so you will not find it by looking: you set it on the command line with --permission-mode dontAsk. It's built for scripts and CI, where a prompt nobody sees is a hang.

Bypass permissions, bypassPermissions, lets everything through with no checks. The docs are blunt about the scope, which is isolated containers and VMs only.

How auto mode decides what is safe

In Anthropic's own research, 97% of permission prompts in Claude Code get approved. Approving each one gives you control, but on a long task it turns into approval fatigue, and auto mode exists for that.

Claude doesn't approve its own actions in auto mode. A separate classifier checks each risky action against what you asked for. It sees your messages and Claude's tool calls, but not Claude's reasoning or its replies, so the conversation can't talk it into saying yes.

Not every action goes to the classifier. Your deny, ask and allow rules run first. Reading and editing files inside your project is easy to undo, so it skips the check, and shell commands, web fetches and anything that reaches outside your project go through it.

When the classifier denies something, Claude usually looks for a safer way on its own. For example, a force push to main that gets denied can become a push to a new branch. If it keeps getting denied, auto mode pauses and asks you.

Web pages and files can carry hidden instructions too. So before that content reaches Claude, a probe scans every tool result for them and adds a warning to anything suspicious.

Anthropic explains all of it in its video on how auto mode works.

Switching mid-session

In the terminal, press Shift+Tab. The cycle runs Manual, then Accept edits, then Plan, then back. If you are in Auto, the first press takes you to Manual.

The status bar tells you where you are: ⏸ manual mode on, ⏵⏵ accept edits on, ⏸ plan mode on, ⏵⏵ auto mode on.

Two modes are not in that cycle by default. bypassPermissions only appears if you started the session in a way that puts it there, and dontAsk never appears at all, which is why the flag is the only way to reach it.

In VS Code it is the mode indicator at the bottom of the prompt box rather than a keypress, and in the desktop app it is the mode selector.

In the VS Code extension there is a catch worth knowing: picking Manual, Edit automatically or Auto is remembered for your next conversation. Picking Plan or Bypass permissions applies to that conversation only, so a session you thought was still in Plan will not be.

One thing that does not work, and people try it constantly, is asking Claude in chat to change the permission mode. It is a control, not a request.

Which one I actually use

I use Auto for most things.

It approves what passes its safety check and stops for anything risky, which is the behaviour people are reaching for when they turn permissions off entirely. You get through a long task without babysitting it, and it still pauses at the parts worth pausing at.

Accept edits earns its place when you are working through a specific file and every prompt is the same yes. And Manual is right the moment the work touches something you would not want changed by accident.

The point is that these are session controls, not a preference you set once. Shift+Tab exists because the right answer changes 3 times in an afternoon.

The rest of my setup, including the AI OS every session reads, is on How I use AI.

What no mode will auto-approve

Bypass does not mean bypass everything, and this is the part worth knowing before you trust it.

Claude Code never auto-approves anything matched by an explicit ask rule, any tool that needs you (like a question it asks you directly), or rm and rmdir targeting a critical path. That last one cannot be approved by an allow rule or a hook either.

So the floor is higher than the name suggests. But that is a floor, not a safety net, and the docs still scope bypass to isolated machines.

Rules beat modes

A deny rule blocks in every mode, including bypassPermissions.

An allow rule does the opposite: it has no effect in bypassPermissions, because there is nothing left to allow.

Writes to protected paths are never auto-approved except in bypass, or in a plan-mode session where bypass is already available.

So if there is 1 thing you want never touched, a deny rule is the way to say it. Putting it in CLAUDE.md is a request, and a rule is enforcement.

More AI coding tools I've reviewed

These are my reviews of Claude Code and the agents I compare it with:

Claude Code

Paid

AI coding agent that also writes, researches, and runs full business workflows from plain English.

Code assistantsAI agentsLLMProductivity

Codex

Paid

OpenAI's agentic coding assistant that writes, edits, and ships code from natural-language instructions.

Code assistantsAI agentsProductivity

Cursor

Freemium

Code editor with AI pair-programming and intelligent autocomplete.

Code assistantsProductivity

What to do next

Final thoughts on Claude Code permission modes

These are session controls, not a preference you set once. Shift+Tab exists because the right answer changes 3 times in an afternoon.

Keep reading:

• Claude Code commands – including /permissions, which sets the rules
• Hidden Claude Code commands – /fewer-permission-prompts writes your allowlist for you
• What is Claude Code? – what it can reach on your machine, and what it cannot
• How to build an AI operating system (AI OS) – the files every mode reads the same way

Then write your first deny rule, for the one folder you never want touched.