Lesson 2 of 9 · Claude Code

Permission modes and safety

Claude Code can read, edit, and run things on your computer. A permission mode decides which of those it does without asking you first. Six modes, one keyboard shortcut, and git as the undo button.

If you took the Agents module, you already know why permissions exist: a tool is a thing the model can ask for, a permission is whether it gets it, and the dial between "ask me every time" and "just do it" is the whole safety story. That lesson is Tools and permissions. This one is about Claude Code's specific dial: what the settings are called, which one you are in right now, how to change it, and what stays locked no matter which one you pick.

Everything here is as of September 2026 and checked against the official Claude Code docs. Versions before 2.1.200 show the first mode under a different label, so if your screen disagrees, the docs win.

The six modes

A permission mode is a session-wide setting that says which actions Claude can take without stopping to ask. Every mode lets Claude read files inside the folder you launched it in. The modes differ on everything else: editing files, running shell commands (a shell command is a line you could type in the terminal yourself, like npm test), and reaching the network. Tap each mode below and watch the same five actions land differently.

Tap a mode: five actions, what happens to each

Reads run without asking. Everything that edits, runs, or reaches the network prompts you first.

Read src/app/page.tsxRuns
Edit src/app/page.tsxAsks you
Run npm testAsks you
Run rm -rf node_modulesAsks you
Fetch a web pageAsks you

Behavior summarized from the Claude Code permission docs as of September 2026. Auto mode's classifier is a model, so its calls vary. Protected paths and deny rules override every mode except bypass.

Each mode has two names, and both show up. The config value is what you type in a flag or a settings file. The label is what the screen calls it. The mode that asks before everything is labeled Manual in the terminal, in the VS Code and JetBrains extensions, and in the desktop app, but its config value is default, because that is what it was called first. Since version 2.1.200 the terminal also accepts manual as an alias. The other five are acceptEdits (Accept edits), plan (Plan), auto (Auto), dontAsk (Don't ask), and bypassPermissions (Bypass).

Manual reads freely and asks before every edit, every command outside a small built-in read-only set, and every web fetch. Best for sensitive work and code you do not know yet.
Accept edits also lets file edits inside your project through, plus common filesystem commands like mkdir, mv, cp, sed, and rm on paths inside the project. That last one matters: in this mode Claude can delete a file in your project without asking. Other commands still prompt.
Plan is look-before-you-touch. Claude reads and thinks, then writes a plan you approve before any edit happens. Commands that are not read-only get reviewed by the auto-mode classifier when auto is available, and prompt you when it is not.
Auto replaces you with a second model called the classifier, which reviews each action before it runs and blocks the risky ones. More on it below.
Don't ask denies anything that would have prompted, instead of waiting. Built for scripts and CI where nobody is sitting at the keyboard.
Bypass skips prompts and safety checks. The docs reserve it for isolated containers and virtual machines, and Claude Code refuses to start in it as root. Not your laptop.

Which mode you start in, and how to switch

As of September 2026, if you are on a Pro, Max, or Team plan and launch Claude Code in a terminal or through the VS Code extension, a new session starts in Auto, and Claude Code prints a notice at the top of the session the first time. Enterprise plans, Console API keys, and non-interactive runs with claude -p start in Manual. If auto mode is unavailable for any reason, the session falls back to Manual too.

To change modes mid-session in the terminal, press Shift+Tab. It cycles. From Auto, the first press goes to Manual. From there the cycle runs Manual, then Accept edits, then Plan, then back to Manual. Auto slots into the cycle after Plan when it is available. Bypass only appears in the cycle if you launched with a flag or a user-level setting that enables it. Don't ask never appears in the cycle at all; it is a launch-time choice. The status bar tells you where you are, with text like "accept edits on" or "plan mode on."

To pick the mode for one session, pass the flag when you launch:

claude --permission-mode plan

To pick it for every session on your machine, set permissions.defaultMode in ~/.claude/settings.json. A project can set the same key in its own .claude/settings.json for every value except auto and bypassPermissions, which Claude Code ignores from project files on purpose, so a repo you cloned cannot quietly turn your prompts off. The desktop app remembers the mode you picked per folder. Cloud sessions on claude.ai offer Accept edits, Plan, and Auto, and never Bypass.

Auto's classifier and Plan mode, up close

Auto mode is the one that changed the daily feel of the tool. Instead of you clicking yes forty times, a separate model reads each action Claude wants to take and decides. It trusts your working folder and the git remotes that were set up when the session started, and treats everything else as outside. By default it blocks downloading and running code (the curl | bash pattern), production deploys, force pushes, granting permissions, mass deletion on cloud storage, and destroying files that existed before the session started. It also blocks the git commands that throw away uncommitted work, like git reset --hard and git checkout -- ., because it presumes you did not mean to lose that.

When the classifier blocks something, you see a notification and the action lands under a "Recently denied" tab in /permissions, where you can retry it with a manual yes. If it blocks three actions in a row, or twenty in a session, auto mode pauses and Claude Code goes back to prompting you. That is a signal worth noticing.

Plan mode is the opposite temperament. Enter it with Shift+Tab, or put /plan in front of a single prompt. Claude explores and writes up what it intends to do. When the plan is ready it asks how to proceed, and the choices are "Yes, and use auto mode," "Yes, manually approve edits," or "No, keep planning." Press Ctrl+G first to open the plan in your text editor and change it yourself before Claude starts. Approving a plan exits Plan mode and drops you into whichever mode the option named. Pressing Shift+Tab again leaves Plan mode without approving anything. For a business owner, Plan mode is the cheapest insurance in the tool: one extra read before the first edit, on every job that touches more than one file.

The hard part, simply

Instructions are a sign on the door. Permissions are the lock. The single most common mistake is writing "never push to main" in a CLAUDE.md file and believing that settled it. It did not. Claude Code's own docs say it plainly: permission rules are enforced by Claude Code, not by the model. Text in your prompt or your CLAUDE.md shapes what Claude tries to do. It does not change what Claude Code allows.

Think of a landscaping crew in Washington with a note taped to the truck: "Do not take the skid steer to the Hurricane job." Most days the note works. On the day it does not, the note is not what stops the truck. The key in the office drawer is.

Worked example. You type "don't push anything until I review" into the chat. In auto mode the classifier does honor that; it re-reads your boundary from the transcript every time it checks an action. But the boundary lives in the conversation, so when the session gets long and Claude Code compacts old messages to save room, the sentence can vanish and the boundary goes with it. A deny rule does not live in the conversation. Put Bash(git push *) under permissions.deny in your settings and the push is blocked in every mode, including Bypass, whether or not anyone remembers the sentence. Signs for guidance, locks for guarantees.

What no mode turns off

A few things sit outside the dial. Protected paths are a short list of folders and files that Claude Code never auto-approves writes to, because corrupting them breaks the repo or Claude's own configuration: .git, .claude, .vscode, .idea, .husky, your shell startup files like .zshrc, and config like .mcp.json. In Manual and Accept edits a write there prompts you. In Auto it goes to the classifier. In Don't ask it is denied. Only Bypass lets it through. An allow rule you wrote yourself cannot pre-approve these either; the check runs before your rules do. A second list, the critical paths, covers rm commands aimed at your home folder, the filesystem root, or the working directory and its parents. Those ask you even in Bypass.

Then there are permission rules, which lesson 9 covers in depth, so one paragraph here. A rule names a tool and optionally a pattern, like Bash(npm test) or Read(./.env), and lives under allow, ask, or deny in a settings file. Rules are evaluated deny first, then ask, then allow, and the first match wins regardless of how specific the other rules are. Deny holds in every mode, including Bypass. Allow rules have no effect in Bypass because nothing prompts there anyway. When you answer a prompt with "Yes, and don't ask again," Claude Code writes an allow rule for you into .claude/settings.local.json at the root of the repo, so that command stays approved in future sessions. Run /permissions any time to see every rule and which file it came from.

Last, the sandbox, which is a different kind of boundary. Modes decide whether Claude asks before a command runs. The sandbox decides what the command can reach once it does run: the operating system itself fences which files and which network hosts a shell command and its child processes can touch. It covers shell commands only, not the file-edit tools. Turn it on with /sandbox, which works on macOS, Linux, and WSL2 but not native Windows, and pick auto-allow (sandboxed commands run without a prompt) or regular permissions (prompts stay). The sandbox and the permission mode are independent and stack: auto-allow inside the sandbox plus Manual mode is the docs' own recipe for fewer prompts without a classifier. And because the OS enforces it, the fence holds even if a web page Claude read talked it into trying something it should not.

Git as the undo button

None of the above replaces the oldest safety tool in software. Git is the version-tracking system under nearly every code folder; a commit is a saved snapshot of every file at one moment. If you only learn three git commands for working with Claude Code, learn these, and you run them, not Claude.

Before a big ask, commit. Run git add -A then git commit -m "before claude: new booking form". Now there is a snapshot of the working state, and nothing Claude does in the next hour can lose it.
After Claude finishes, look. git diff shows every line that changed since that snapshot, added in green, removed in red. Read it the way you would read a contractor's invoice: line by line, before you pay.
To throw one file's changes away, run git checkout -- path/to/file. The file goes back to the snapshot. Claude's version of it is gone and nothing else is touched.

Say a St. George tint shop asks Claude to rework the pricing page and it also "helpfully" rewrote the contact form. The diff shows both. One checkout on the contact form keeps the pricing work and drops the rest. That is a thirty-second fix with a commit behind it and an afternoon without one. Notice that auto mode's classifier blocks Claude from running the wide versions of this, git checkout -- . and git reset --hard, on your uncommitted work. That is the right default. The undo button belongs to the human.

Try this yourself

Open a terminal in any project folder, ideally one with a git commit already in it, and start in Plan mode:

claude --permission-mode plan

Then ask for a real change:

Add a "Request a quote" section to the home page for a gutter company in Washington, Utah. It needs a name field, a phone field, a short message box, and a submit button that emails the shop. Match the existing page style. Before editing anything, tell me every file you plan to touch and why.

Read the plan. Check the file list against what you expected; if it names a file you did not think a quote form should touch, that is the conversation to have now, not after. Press Ctrl+G if you want to edit the plan yourself. Then pick "Yes, manually approve edits" and watch each prompt come in, or press Shift+Tab to leave Plan mode without approving and try a narrower ask. When it is done, git diff.

Next lesson3. CLAUDE.md: user, project, and local

Last updated September 17, 2026