8 min · +120 XP
Who approves what Claude does
The six permission modes, and which one to use when.
By the end of this lesson
You will be able to tell which permission mode you are in, switch it, and choose the right one for a task.
Before Claude edits a file or runs a command, something has to decide whether that action may go ahead. Either you approve it, or a rule does, or a second model checks it for you. The permission mode sets which of these happens.
The six modes in plain words
- 1Manual: Claude may read files on its own, and asks you before it edits a file or runs a command. In settings this mode is called default.
- 2acceptEdits: Claude edits files in the project folder and runs simple file commands (create a folder, copy, move, delete) inside it without asking. Other commands still need your answer.
- 3plan: Claude studies the files and writes a plan, but changes nothing until you approve the plan. The next lesson is about this mode.
- 4auto: Claude works without asking, and a separate model reviews each action before it runs. It blocks actions that go beyond your request or look dangerous.
- 5dontAsk: anything not allowed in advance is refused without a question. It is meant for scripts and automatic checks, not for everyday work.
- 6bypassPermissions: no checks at all. It is meant only for isolated containers and virtual machines, where nothing important can be damaged.
Press Shift+Tab in Claude Code to move to the next mode, and look at the line under the prompt to see which one is on. In recent versions a new session in the terminal or VS Code starts in auto mode; if auto mode is not available for your account or model, it starts in Manual. On Windows, if Shift+Tab does nothing, try Alt+M.
Which mode to use when
- 1Building your own tool in its own folder: auto. Claude works without constant questions, and risky actions are still stopped.
- 2Something sensitive, or you want to see every step: Manual.
- 3You plan to look through the changes afterwards yourself: acceptEdits.
- 4A bigger change, or code you do not know yet: plan first, then auto or Manual.
- 5Scripts and automatic checks that run without a person: dontAsk with a list of allowed actions.
- 6A disposable container or virtual machine with nothing valuable inside: bypassPermissions, and only there.
›How to answer a permission question
In Manual mode Claude Code shows the command it wants to run and asks "Do you want to proceed?". Use the arrow keys and Enter to choose: Yes (this once), Yes, and don't ask again for this kind of command, Yes, and switch to auto mode (when available), or No. Esc cancels. If you do not understand the command, choose No and ask with the phrase below.
“Explain in simple words what this command does and why you need it. Do not run it until I say yes.”
Claude explains the command and waits for your answer.
What auto mode still stops
Even in auto mode Claude stops before risky actions: running code downloaded from the internet, sending passwords or keys anywhere, deleting files that existed before the session, publishing your site. Then it asks you or looks for a safer way.
Blocked by default, even in auto mode
- 1Downloading and running code from the internet, such as curl | bash.
- 2Sending sensitive data to outside addresses, and printing a live password or token into the conversation.
- 3Deploying to production, and mass deletion in cloud storage.
- 4Destroying files that existed before the session, and git commands that throw away unsaved work (git reset --hard, git clean -fd).
- 5Force push, and changing where Git pushes your code.
- 6Starting another agent with all checks switched off.
- 7When something is blocked, you see a notice and Claude looks for another way. After 3 blocks in a row or 20 in a session, Claude Code goes back to asking you.
Auto mode also respects limits you state in the conversation, such as "don't push anything" or "wait for me before deleting". The documentation itself warns that auto mode reduces questions but does not guarantee safety. Keep each project in its own folder and keep backups, as the safety lesson explains.
This flag starts the bypassPermissions mode: no checks, no protection against misleading content, and Claude can change anything your user account can. The documentation says to use it only in isolated environments such as containers and virtual machines. This course does not use it on personal computers; auto mode gives you the same comfort with checks in place.
Modes set the baseline; permission rules sit on top. Ask Claude to add allow, ask and deny rules to the project settings ("add a deny rule so you can never read .env, and an ask rule for git push"), or open /permissions and add them there, for example deny Read(./.env) or ask Bash(git push *). Rules are checked in the order deny, ask, allow, and deny rules apply in every mode, including bypassPermissions. A limit stated in conversation can be lost when the context is compacted, so use a deny rule for a hard guarantee. /sandbox turns on OS-level isolation for shell commands on macOS, Linux and WSL2 (native Windows runs them unsandboxed). In /permissions, the Recently denied tab lists auto mode blocks; press r to retry one with manual approval.
You are building a habit tracker in a new folder and want Claude to work without asking about every file. Which mode fits?
You want Claude to change how payments work in your shop's code, and you want to see what it intends before anything changes. Which mode?
Facts checked against the official Claude Code docs October 24, 2026 · source
Author
Evgenii Arsentev
PhD · Chief Executive Officer, digital health