Claude Code Auto Mode: What It Allows and How to Configure It

If you opened Claude Code recently and noticed it stopped asking permission before editing files — that's auto mode. Since version 2.1.283, it's the built-in default for every plan and provider (on earlier versions, only for Pro, Max, and Team). Instead of pausing before every action, Claude works continuously while a second AI model called the 'classifier' reviews each action in the background. You only see a prompt when something genuinely needs your judgement. The status bar shows '⏵⏵ auto mode on' so you always know it's active.

I run almost everything in auto mode now. The shift happened when I realized I was clicking 'allow' a hundred times per session without actually reading the prompts. Auto mode replaces rubber-stamp approvals with a classifier that actually understands the difference between 'delete this test fixture' and 'drop this production table'. Today I only manually review the two actions that matter — git push and PR creation — and I've added ask rules for those specifically. Setup took ten minutes.

1What does Claude Code auto mode allow?

The classifier's baseline is: anything reversible, local, and aimed inside your project. In practice, this covers reading any file, editing code and configs, running tests and build commands, npm and pip installs from public registries, git add/commit/diff, pushing branches in your own repository, and creating pull requests on that same repo. Each action gets evaluated as Claude proposes it — the classifier approves silently or flags it. Routine development work flows without interruption.

2What auto mode still blocks and asks about

Auto mode is not 'skip all safety'. The classifier blocks anything that looks irreversible, destructive, or pointed outside your environment: force pushes, deletions of cloud resources, shell commands aimed at remote hosts you haven't declared as trusted, and anything that resembles exfiltration — sending your code or data to an unexpected destination. Any permission rule you've explicitly set (an ask rule or a deny rule) runs before the classifier and always overrides it. If you've told Claude Code to ask before git push, it will ask, even in auto mode.

One protection added recently: in auto mode, Claude Code will ask before Claude first reads a file that lives outside your working directories — and gives you the option to block all such out-of-directory reads from that point on. This is a one-time prompt per new location, not a constant interruption.

3How do you switch out of auto mode?

Press Shift+Tab to cycle through permission modes. From auto, one press switches you to Manual mode — the status bar changes from '⏵⏵ auto mode on' to '⏸ manual mode on'. Another press goes to acceptEdits mode (file edits and common filesystem commands run without asking, but shell commands still prompt), then plan mode, then back. You can switch at any point in a session, including while Claude is already working. To make Manual mode the permanent default, add one setting to your user config.

When you're in Manual or acceptEdits mode and Claude requests a Bash command, the permission prompt now includes a 'Yes, and switch to auto mode' option. Choosing it approves the command and switches the entire session to auto mode in one click — handy when you realize mid-task that you'd rather stop approving every step.

{
  "permissions": {
    "defaultMode": "default"
  }
}

4Editing auto mode rules visually: the /permissions Auto mode tab

You don't have to hand-edit settings.json to adjust what the classifier allows or blocks. Open /permissions inside Claude Code and click the Auto mode tab — it shows your current auto mode classifier rules in a visual editor. You can add, edit, or remove rules without touching a config file. Changes take effect immediately for the session and are written back to settings.json when you save.

5How to keep auto mode but add checkpoints for important actions

You don't have to choose between 'always ask' and 'never ask'. The most practical setup: leave auto mode on for routine work, but add explicit ask rules for the two actions with real consequences. Claude handles the thousand small decisions autonomously; you review the two that matter.

{
  "permissions": {
    "ask": [
      "Bash(git push *)",
      "Bash(gh pr create *)"
    ]
  }
}

6If auto mode blocks things it shouldn't: /auto-mode-setup

By default, the classifier trusts your working directory and its configured git remotes. If it's blocking pushes to your company's GitHub org, writes to a shared cloud bucket, or calls to an internal service, run /auto-mode-setup. Claude scans your project settings and recent sessions, drafts environment entries that describe your infrastructure in plain language, and writes them to ~/.claude/settings.json when you approve. After saving, run 'claude auto-mode config' in a terminal to confirm the effective rules. Requires Pro, Max, or Team and Claude Code v2.1.228 or later.

7Auto mode vs dangerously-skip-permissions: not the same thing

Auto mode still has an active safety layer — the classifier reviews every action. 'dangerously-skip-permissions' (the --dangerously-skip-permissions flag, or bypassPermissions mode) removes all checks entirely: no classifier, no permission prompts, nothing. It exists for isolated containers and VMs where the blast radius is bounded by isolation rather than by any safety review.

The practical upshot: auto mode is the right choice for daily development work, including on projects with real stakes. bypassPermissions is a power tool for CI/CD pipelines running inside sandboxed containers. If you're using bypassPermissions in a normal terminal session on your actual machine, you've gone further than the docs recommend. Try auto mode with a couple of ask rules added — it's the point the design intends.