Guides

Claude Code permission modes: default, acceptEdits, plan, auto and bypassPermissions

Published October 30, 2026 · Last checked October 30, 2026

Most people who search for how to skip permission prompts are tired of approving one action after another. This page follows Anthropic's Choose a permission mode doc to explain what each permission mode lets Claude do without asking, how to switch modes, and why bypassPermissions belongs only in isolated environments. Mode names, flags, setting keys and behavior all come from that doc, checked on October 30, 2026.

The permission modes

The doc says a permission mode sets which actions Claude can take in a session without asking you first. In Manual mode, Claude Code stops and asks you before most actions that edit files, run shell commands, or reach the network. The table below is the doc's table of what runs without a permission prompt in each mode. Manual mode appears under its config value, default.

The mode that reviews every action is named Manual in the CLI, in claude --help, in the VS Code and JetBrains extensions, and in the desktop app. Its config value is default, which is what hooks and SDK integrations use. The CLI accepts manual as an alias wherever you type the value, for example claude --permission-mode manual or "defaultMode": "manual".

Switching modes

During a session: press Shift+Tab to cycle permission modes. From auto, the first press switches to default, and the cycle then runs default → acceptEdits → plan. Optional modes slot in after plan. The status bar shows the active mode:

Not every mode is in the default cycle:

• auto: appears when auto mode is available; cycling to it switches permission modes without a confirmation prompt.
• bypassPermissions: appears after you start with --permission-mode bypassPermissions, --dangerously-skip-permissions, --allow-dangerously-skip-permissions, or permissions.defaultMode: "bypassPermissions" in user, --settings, or managed settings. The --allow- variant adds the permission mode to the cycle without activating it.
• dontAsk: never appears in the cycle; set it with --permission-mode dontAsk.

Enabled optional modes slot in after plan, with bypassPermissions first and auto last. If you have both enabled, you will cycle through bypassPermissions on the way to auto.

From a Bash permission prompt: in the Manual and acceptEdits permission modes, when auto mode is available, Claude Code adds Yes, and switch to auto mode to a Bash command's permission prompt. Select it to approve the command and switch the session to auto mode. PowerShell tool prompts don't offer the option, and it requires Claude Code v2.1.247 or later. Claude Code doesn't add the option to prompts forced by one of your ask rules or by a hook, because auto mode still shows you those prompts, so switching wouldn't remove them.

At startup: pass the permission mode as a flag. The same --permission-mode flag works with -p for non-interactive runs.

claude --permission-mode plan

As a default: set permissions.defaultMode at the scope you want. In VS Code, click the mode indicator at the bottom of the prompt box, or pin the starting mode with claudeCode.initialPermissionMode.

Which mode a session starts in

When you start a new session in a terminal, Claude Code takes the permission mode from the first of these that applies:

1. The --permission-mode flag, or --dangerously-skip-permissions
2. permissions.defaultMode in a settings file
3. The built-in default

With Claude Code v2.1.283 or later, the built-in default is auto in a terminal or through the VS Code extension. On earlier versions, it is auto on Pro, Max, or Team plans in sessions that fetch feature flags, and default otherwise. For claude -p and the Agent SDK, the built-in default is default. It is also default when any settings file sets disableAutoMode to "disable". When the flag, a settings file, or the built-in default selects auto but auto mode isn't available to the session, Claude Code starts the session in Manual instead.

Where you put the setting matters, and the doc is specific:

If you set "auto" in .claude/settings.json or .claude/settings.local.json, the value doesn't take effect. If you set "bypassPermissions" in those two files, it doesn't take effect either, and the session starts in Manual mode. This example makes every terminal session on your machine start in Manual mode; save it in ~/.claude/settings.json:

{
  "permissions": {
    "defaultMode": "default"
  }
}

The next session you start shows ⏸ manual mode on in the status bar.

acceptEdits: auto-approve file edits

acceptEdits mode lets Claude create and edit files in your working directory without prompting. The status bar shows ⏵⏵ accept edits on while this mode is active. In addition to file edits, it auto-approves common filesystem Bash commands: mkdir, touch, rm, rmdir, mv, cp, and sed. Like file edits, auto-approval applies only to paths inside your working directory or additionalDirectories.

These still prompt:

• Paths outside that scope
• Writes to protected paths
• Recognized rm and rmdir critical-path removals
• touch with anything beyond plain file paths, for example an option, a glob, or a prefix such as timeout 5 or LANG=C
• All other Bash commands except the built-in read-only set

The doc suggests using acceptEdits when you want to review changes in your editor or via git diff after the fact rather than approving each edit inline. Press Shift+Tab once from Manual mode to enter it, or start with it directly:

claude --permission-mode acceptEdits

plan: research first, no edits

Plan mode tells Claude to research and propose changes without making them. Claude reads files, runs shell commands to explore, and writes a plan, but does not edit your source. Except in interactive terminal sessions with bypass permissions available, edits stay blocked until you approve the plan.

What happens to a shell command during planning depends on the session, and the first of these cases that matches applies:

• Interactive terminal sessions with bypass permissions available: neither the classifier nor a prompt applies to planning commands.
• Auto mode available and the useAutoModeDuringPlan setting on, which it is by default: the classifier reviews shell commands other than critical-path removals instead of prompting you. Approved commands run, and rejected ones are blocked.
• Auto mode not available, or useAutoModeDuringPlan off: commands outside the built-in read-only set prompt for approval.

Enter plan mode by pressing Shift+Tab or prefixing a single prompt with /plan. You can also start in plan mode from the CLI:

claude --permission-mode plan

Press Shift+Tab again to leave plan mode without approving a plan. When the plan is ready, Claude presents it and asks how to proceed:

• Yes, and use auto mode: approve and start in auto mode. If auto mode isn't available to your session, this option reads Yes, auto-accept edits. If you started the session with bypass permissions enabled, it reads Yes, and switch to BYPASS PERMISSIONS (no further prompts) for this session instead.
• Yes, manually approve edits: approve and review each edit individually.
• No, keep planning: stay in plan mode and tell Claude what to change.

Press Ctrl+G to open the proposed plan in your default text editor and edit it directly before Claude proceeds. To make plan mode the default for a project's terminal sessions, set defaultMode to plan in .claude/settings.json.

auto: a classifier reviews for you

Auto mode lets Claude execute without routine permission prompts. A separate classifier model reviews actions before they run, blocking anything that escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read. Explicit ask rules still force a prompt.

Warning from the doc: Auto mode reduces permission prompts but does not guarantee safety. Use it for tasks where you trust the general direction, not as a replacement for review on sensitive operations.

Auto mode is available only when your account meets all of these requirements:

• Plan: All plans.
• Organization: on Team and Enterprise, auto mode is available by default. Administrators can turn it off for the organization by setting permissions.disableAutoMode to "disable" in managed settings.
• Model: on the Anthropic API and Claude Platform on AWS, Claude Opus 4.6 or later, Sonnet 4.6 or later, Haiku 5.5, or a Fable model. On Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry, and signed-in Claude apps gateway sessions, only Claude Sonnet 5 or later, Opus 4.7 or later, Haiku 5.5, and the Fable models. Older models, including Sonnet 4.5, Opus 4.5, Haiku 4.5, and claude-3 models, are not supported on any provider.
• Provider: available by default on the Anthropic API, Claude Platform on AWS, Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry, and signed-in Claude apps gateway sessions.

Blocked by default, among a longer list in the doc: downloading and executing code like curl | bash, sending sensitive data to external endpoints, production deploys and migrations, force push, granting IAM or repo permissions, and irreversibly destroying files that existed before the session. Allowed by default: local file operations in your working directory, installing dependencies declared in your lock files or manifests, and read-only HTTP requests. Run claude auto-mode defaults to print the full rule lists as JSON.

The classifier treats boundaries you state in the conversation as a block signal: tell Claude "don't push" and it blocks matching actions even when the default rules would allow them. Boundaries are not stored as rules, though, and context compaction can remove the message that stated one. For a hard guarantee, the doc says to add a deny rule instead.

Fallback: a blocked action shows a notification and is listed in /permissions under the Recently denied tab, where you can press r to retry it with a manual approval. If the classifier blocks an action 3 times in a row or 20 times total, auto mode pauses and Claude Code resumes prompting; approving the prompted action resumes auto mode. These thresholds are not configurable.

Cost and latency: the doc says classifier requests can run on a model other than your /model selection. On Enterprise plans and on accounts that use the Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry, classifier calls count toward your token usage. Each check sends a portion of the transcript plus the pending action, adding a round-trip before execution. Reads and working-directory edits outside protected paths skip the classifier, so the overhead comes mainly from shell commands and network operations. Where the server reviews the actions as part of the session's model requests, there are no separate classifier calls. When you point ANTHROPIC_BASE_URL at an LLM gateway or proxy, Claude Code v2.1.278 or later asks the server by default, but falls back to its own classifier requests when the gateway or proxy drops the request for review or the results. If /status shows Auto mode server as Enabled, classifier requests are sent only for calls outside the server's review. For the money side, see our note on spending fewer tokens.

bypassPermissions: skip all checks

bypassPermissions mode disables permission prompts and safety checks so tool calls execute immediately, including writes to protected paths. This is the mode most "skip permission prompts" searches are looking for, and the doc's warnings are blunt.

Warning from the doc: Only use this mode in isolated environments like containers, VMs, or dev containers without internet access, where Claude Code cannot damage your host system.

Warning from the doc: bypassPermissions offers no protection against prompt injection or unintended actions. For background safety checks with far fewer permission prompts, use auto mode instead. Administrators can block this mode by setting permissions.disableBypassPermissionsMode to "disable" in managed settings.

How to enable it, and the limits:

• You can't enter bypassPermissions from a session you started without it enabled. Enable it at launch with permissions.defaultMode: "bypassPermissions" or claude --permission-mode bypassPermissions. The --dangerously-skip-permissions flag is equivalent.
• The first time you start an interactive session with this mode enabled, Claude Code shows a warning dialog asking you to accept responsibility for actions taken without permission checks. If you accept, Claude Code sets skipDangerousModePermissionPrompt to true in ~/.claude/settings.json, so later sessions skip the dialog. If you decline, Claude Code exits.
• On Linux and macOS, Claude Code refuses to start in bypassPermissions mode when running as root or under sudo. The check is skipped automatically inside a recognized sandbox. To run autonomously in a container, use the dev container configuration, which runs Claude Code as a non-root user.
• In VS Code, bypass permissions requires the Allow dangerously skip permissions toggle in the extension settings; without it, the mode doesn't appear in the indicator.
• Cloud sessions don't honor defaultMode: "bypassPermissions" or "dontAsk" from your settings files, so a repository's checked-in settings can't start a cloud session in bypass-permissions mode.

Even in this mode, each of the actions no mode auto-approves still gets a prompt or a denial: tools matched by an explicit ask rule, tools that require user interaction such as AskUserQuestion, and recognized rm and rmdir critical-path removals such as rm -rf / and rm -rf ~. The doc also notes the critical-path check can miss some commands, so it doesn't replace an operating-system control such as sandboxing.

dontAsk: only pre-approved tools

If you set dontAsk mode, Claude Code auto-denies every tool call that would otherwise prompt you. File reads inside your working directories, read-only Bash commands, actions matching your permissions.allow rules, and calls approved by a PreToolUse hook still run. The doc says to use this mode for CI pipelines or restricted environments where you pre-define what Claude may do; the session never waits for input. For writing hooks, see our hooks guide. Set it at startup with the flag:

claude --permission-mode dontAsk

The doc's example for CI with an exact allowlist:

claude -p "run the test suite" --permission-mode dontAsk --allowedTools "Bash(npm test)" "Read"

Rules instead of blanket modes

The doc says modes set the baseline, and you can layer permission rules on top to pre-approve or block specific tools:

• Deny rules block in every mode, including bypassPermissions.
• Allow rules have no effect in bypassPermissions.
• To require a human checkpoint before certain commands while staying in auto mode, add permissions.ask rules.
• On entering auto mode, broad allow rules that grant arbitrary code execution are dropped, such as blanket Bash(*) or PowerShell(*), wildcarded interpreters like Bash(python*), package-manager run commands, and Agent allow rules. Narrow rules like Bash(npm test) stay in effect, and Claude Code restores the dropped rules when you leave auto mode.
• Another way to get fewer prompts without a classifier, from the doc's common setups: Manual mode plus the Bash sandbox in auto-allow mode. Run claude --permission-mode default, then run /sandbox and select auto-allow. It needs the built-in Bash sandbox, on macOS, Linux, and WSL2.

The rule syntax is in Anthropic's Permissions doc; for the /permissions command see Claude Code commands.

Protected paths

Writes to a small set of paths are never auto-approved, except in bypassPermissions mode (and interactive terminal sessions in plan mode with bypass permissions available). This prevents accidental corruption of repository state and Claude's own configuration. In default and acceptEdits they prompt, in auto they go to the classifier, and in dontAsk they are denied. Protected directories include .git, .vscode, .idea, .husky and .claude (with a few exceptions); protected files include .gitconfig, .bashrc, .zshrc, .npmrc, .mcp.json and .claude.json, among others. The full list is in the Protected paths section of the doc. permissions.allow rules in settings files do not pre-approve protected-path writes.

Which mode should I use

These suggestions are our reading of the sections above, not an official decision tree:

• Unfamiliar code, sensitive work: default (Manual).
• Iterating on code you are watching: acceptEdits, and look at the changes afterwards with git diff.
• You want to understand a codebase before touching it: plan.
• Long tasks where you don't want to be interrupted but still want safety checks: auto, remembering the doc says it does not guarantee safety.
• CI and scripts: dontAsk with an --allowedTools allowlist.
• Truly unattended runs: bypassPermissions, only in an isolated environment such as a container or VM, running as a non-root user.

FAQ

Sources

• Claude Code: Choose a permission mode (every mode, flag, setting key, shortcut and limit on this page)
• Claude Code: Permissions (allow, ask and deny rules; linked from the doc above, not quoted line by line here)
• Claude Code: Configure auto mode (trusted infrastructure for auto mode; linked from the doc above, not quoted line by line here)