Claude Code Permissions and Modes

1:52 Claude Code decides what Claude may do without asking through permission rules (allow, ask and deny lists in settings) and a permission mode: default (shown as Manual), acceptEdits, plan, auto, dontAsk or bypassPermissions; press Shift+Tab to cycle modes, and since version 2.1.283 interactive terminal and VS Code sessions start in auto mode (Choose a permission mode, read Nov 6, 2026). --dangerously-skip-permissions is the same as bypass mode: it removes prompts and safety checks, and Anthropic recommends it only inside an isolated container or virtual machine.

Quick facts

Sources for the table: Choose a permission mode, Configure permissions and Configure the sandboxed Bash tool, Anthropic, read Nov 6, 2026.

The six permission modes

Source: Choose a permission mode, read Nov 6, 2026. Some actions are never approved automatically in any mode: explicit ask rules, the AskUserQuestion tool, and removals of critical paths such as rm -rf / or rm -rf ~.

How do you switch modes?

In the terminal, Shift+Tab moves from Manual to Accept edits to Plan; Bypass and Auto join the end of the cycle when they are available. To start in a mode, use claude --permission-mode plan (or any other mode name), or set permissions.defaultMode in settings. In VS Code the mode picker reads Manual, Edit automatically, Plan, Auto and Bypass permissions; the desktop app has a selector under the prompt box. Cloud sessions at claude.ai/code offer Accept edits, Plan and Auto, but no bypass mode (Choose a permission mode, read Nov 6, 2026).

Plan mode

0:40 In plan mode Claude reads files and runs commands to explore, then writes a plan without touching your source. Enter it with Shift+Tab, /plan or claude --permission-mode plan. When the plan is ready you choose "Yes, and use auto mode", "Yes, manually approve edits" or "No, keep planning", and Ctrl+G opens the plan to edit it yourself (Choose a permission mode, read Nov 6, 2026). The opusplan model setting uses Opus in plan mode and Sonnet to carry the plan out.

Auto mode

1:05 In auto mode a separate classifier model reviews each action before it runs and blocks anything that goes beyond your request, reaches unfamiliar infrastructure, or looks driven by hostile text Claude read. Blocked by default: curl | bash style download-and-run, sending sensitive data out, production deploys and migrations, mass cloud deletion, granting access rights, force pushes, git reset --hard, terraform destroy, DNS changes and merging unapproved pull requests (Choose a permission mode, read Nov 6, 2026). After 3 blocks in a row or 20 in total it pauses and goes back to asking; blocked actions are listed under Recently blocked in /permissions.

3:37 Auto mode arrived as a research preview in late March 2026, reached Pro in May, became the default for new sessions on Pro, Max and Team from Aug 14, 2026, and the built-in start mode on every plan with v2.1.283 on Sep 25, 2026 (What's new, read Nov 6, 2026). It needs Opus 4.6 or later, Sonnet 4.6 or later, Haiku 5.5 or a Fable model, and Team and Enterprise admins can disable it. Anthropic's own caution is plain: auto mode "reduces permission prompts but does not guarantee safety", because the classifier is a model making judgment calls. Rules that must never bend belong in deny rules or hooks, which apply before the classifier sees anything (Best practices for Claude Code, read Nov 6, 2026). If the classifier keeps stopping routine work, /auto-mode-setup drafts autoMode.environment entries describing your trusted infrastructure. Developers add those entries in their user settings, ~/.claude/settings.json, and admins in managed settings, which every developer inherits and cannot remove.

What does --dangerously-skip-permissions do?

claude --dangerously-skip-permissions starts in bypassPermissions mode, which disables permission prompts and safety checks: Claude runs any command or edit not caught by a deny or ask rule. Anthropic recommends it only in a container, a VM or a sandbox runtime, and as a non-root user. Claude Code refuses it when running as root or under sudo on Linux and macOS, shows a warning dialog on first use, and cannot switch into bypass mid-session unless the session started with it enabled; --allow-dangerously-skip-permissions adds it to the Shift+Tab cycle without turning it on (Choose a permission mode, read Nov 6, 2026).

2:03 The risk is not only Claude's mistakes. A web page, issue or file Claude reads can carry instructions planted by someone else, and with no checks there is nothing between such text and your shell, your keys and your network. For unattended runs, dontAsk with an explicit allowlist, or auto mode, are the documented alternatives.

Permission rules

12:43 Rules are lists in settings: allow runs without asking, ask always asks, deny always refuses, and deny beats everything. Patterns include Bash(npm run *), Read(./.env), WebFetch(domain:example.com) and, since mid-June 2026, tool parameters such as Agent(model:opus) (Configure permissions, read Nov 6, 2026). Anthropic's example keeps secrets out of reach:

{
  "permissions": {
    "allow": ["Bash(pnpm tsc --noEmit)"],
    "ask": ["Bash(git push *)"],
    "deny": ["Read(./.env)", "Read(./.env.local)", "Read(./secrets/**)"]
  }
}

A Read deny rule also catches cat .env, but not a script that opens the file, and a WebFetch deny does nothing about curl unless the sandbox is on (Best practices for Claude Code, read Nov 6, 2026). "Yes, and don't ask again" saves a rule to .claude/settings.local.json; /permissions shows every rule and its file; /fewer-permission-prompts scans past sessions and allowlists common read-only commands.

The Bash sandbox

The sandbox is an operating-system boundary around the shell commands Claude runs: by default they may write only to the working folder and a temp folder, and reach the network only through a proxy whose allowed domains start empty. It uses Seatbelt on macOS and bubblewrap on Linux and WSL2; on native Windows commands run unsandboxed. It is off until you run /sandbox or set sandbox.enabled, and file tools, hooks and local MCP servers run outside it (Configure the sandboxed Bash tool, read Nov 6, 2026). For full isolation Anthropic points to running Claude Code itself in a container or VM.

Frequently asked questions

What is plan mode in Claude Code? Plan mode lets Claude read and explore but not edit your files, ending with a written plan you approve, edit or reject. Enter it with Shift+Tab, /plan or claude --permission-mode plan.

What is Claude Code auto mode? Auto mode lets Claude act without prompts while a separate classifier model checks each action and blocks risky ones such as force pushes or production deploys. It is the default start mode since v2.1.283, but Anthropic says it does not guarantee safety.

Is --dangerously-skip-permissions safe? Only in an isolated, disposable environment. It turns off prompts and safety checks, so Anthropic recommends it inside a container or VM as a non-root user, and Claude Code refuses it under root or sudo.

How do I stop Claude Code from asking permission every time? Use auto mode, add allow rules for commands you trust, or run /fewer-permission-prompts to allowlist common read-only commands. Choosing "Yes, and don't ask again" also saves a rule for that repository.

Do deny rules work in bypass mode? Yes. Claude Code applies deny rules in every mode, including bypassPermissions, so a deny on Read(./.env) holds even with --dangerously-skip-permissions.

Sources

• Choose a permission mode, Anthropic, read Nov 6, 2026
• Configure permissions, Anthropic, read Nov 6, 2026
• Configure the sandboxed Bash tool, Anthropic, read Nov 6, 2026
• Best practices for Claude Code, Anthropic, read Nov 6, 2026
• What's new, Anthropic, read Nov 6, 2026
• How Claude Code Works, Claude, May 14, 2026 (video)
• Your first Claude Code prompt, Claude, May 15, 2026 (video)
• How auto mode works with Claude Code, Claude, Aug 4, 2026 (video)
• Claude Code best practices | Code w/ Claude, Anthropic, Jul 31, 2025 (video)