Claude Code permission modes, explained

A permission mode decides how much Claude Code may do before it stops and asks you. Picking the right one for the job saves you from both constant interruptions and unpleasant surprises.

The six modes

Manual (default)Runs reads without asking and asks for the rest. Use it to review every action or for sensitive work.
Accept edits (acceptEdits)Also approves file edits and common file commands such as mkdir, mv and cp inside the working directory. Good for iterating on code you are reviewing as you go.
Plan (plan)Claude reads and explores, then writes a plan. It does not edit your source until you approve the plan.
Auto (auto)Runs without asking, with a separate classifier model reviewing each action before it runs. For long tasks where constant prompts get in the way.
Don't ask (dontAsk)Allows only reads and tools you pre-approved, and denies everything else. Meant for locked-down CI and scripts.
Bypass permissions (bypassPermissions)Runs everything with no prompts. The documentation says to use it only in isolated containers and virtual machines.

Deny rules block in every mode, bypass included. Allow rules have no effect in bypass mode.

Which mode a new session starts in depends on your version, plan and settings. The documentation lists the order: the command-line flag first, then permissions.defaultMode in a settings file, then the built-in default.

How to switch

Shift+Tab cycles through the modes in the terminal. Auto shows up in the cycle when it is available, and bypass only if you enabled it when you launched Claude Code. Don't ask never appears in the cycle.
At launch: claude --permission-mode plan.
As a default: set permissions.defaultMode in a settings file. A project's .claude/settings.json or .claude/settings.local.json ignores auto and bypassPermissions.
VS Code, the desktop app and the web app have a mode selector next to the prompt box.

Plan mode, step by step

Press Shift+Tab until you are in plan mode, or type /plan, or launch with --permission-mode plan.
Ask for what you want. Claude explores and writes a plan.
Press Ctrl+G if you want to edit the plan in your editor first.
Choose: approve and continue with auto mode, approve and review each edit yourself, or keep planning and give feedback. If auto mode is not available, the first option reads "Yes, auto-accept edits".

Shift+Tab again leaves plan mode without approving anything. If you want Claude to question you before it builds, see make Claude Code ask first.

What auto mode is, and is not

A separate classifier model reviews actions before they run. By default it blocks things such as piping a download into a shell, sending sensitive data out, production deploys, force pushes and commands such as git reset --hard that would throw away uncommitted work. It allows things like local file work in your project and installing the dependencies your project declares. If it blocks three actions in a row, or 20 in total, it pauses and goes back to asking.

When you enter auto mode it drops broad allow rules that would let any code run, such as Bash(*). Narrow rules such as Bash(npm test) stay. Whether auto is available depends on your plan, provider, model and version. The documentation is clear that it reduces prompts and does not guarantee safety.

Bypass: read this part twice

It switches off prompts and safety checks, including for protected paths, and offers no protection against prompt injection (text inside a page or file trying to steer Claude).
Use it only in an isolated container or virtual machine, ideally with no internet access.
You enable it at launch with --permission-mode bypassPermissions or --dangerously-skip-permissions. It only appears in the Shift+Tab cycle if you started with a bypass option (or set it as your default in your user settings).
On Linux and macOS it refuses to run as root.
If you need a hard guarantee, write deny rules. They hold in every mode. See a starter list of permission rules.

What is never approved automatically

Writes to protected paths are not auto-approved, except in bypass mode. Protected directories include .git, .vscode, .idea and .claude. Protected files include shell startup files such as .bashrc, .npmrc and .mcp.json. An allow rule in a settings file does not pre-approve a write there. Even in bypass mode, a short list of actions, such as removing critical system paths with rm, still prompts or is refused.

Which one to pick

Not sure what a project will do: Manual, or Plan first.
Editing code you are watching: Accept edits.
A long, well-defined task on a project you trust: Auto, with deny rules for what must never happen.
An unattended script: Don't ask, with the tools you need allowed. Or an isolated container if you must use bypass.

Limits

Modes, defaults and requirements change between versions, and several depend on your plan, provider and model. The permission modes page is the authority.
This is general information about a tool, not a security audit.

This follows Anthropic's permission modes documentation as we read it in October 2026. We are not affiliated with Anthropic. We wrote this from the documentation and have not tested every mode on every system.

The free loop-stop skill gives long tasks a limit and a stop rule. If you want a second pair of eyes on your CLAUDE.md and settings, the Tune-Up Kit is a checklist for exactly that.