Autonomy is a dial
How much should Claude do without asking? It depends on the task, the codebase and where it's running. Permission modes are the dial.
| Mode | Runs without asking | Best for |
|---|---|---|
default (Manual) | Reads only | Sensitive work, reviewing every action |
acceptEdits | Reads, file edits and common file commands in your working directories | Iterating while you review the diff |
plan | Reads and research. No edits. | Exploring before changing anything |
auto | Most actions, with a background classifier checking each one | Long tasks with fewer interruptions |
dontAsk | Only pre-approved tools. Everything else is denied. | Locked-down CI and scripts |
bypassPermissions | Everything | Isolated containers and VMs only |
Switching modes
- CLI: Shift+Tab cycles Manual → Accept edits → Plan, and on to Auto when it's available.
- VS Code: the mode indicator in the prompt box.
- Desktop: the mode selector.
- At launch:
claude --permission-mode acceptEdits - As a default:
"permissions": { "defaultMode": "acceptEdits" }in settings.
Auto mode, honestly
Auto mode lets Claude work through long tasks with few prompts while a separate classifier model reviews each action in the background and blocks the risky ones. Recent versions use it as the starting mode for interactive terminal and VS Code sessions. It's a big productivity win, but it's a safety net, not a guarantee. Pair it with deny rules for anything that must never happen, and work on a branch.
bypassPermissions (also --dangerously-skip-permissions) runs everything without asking. Use it only inside isolated, disposable environments like containers or VMs with no access to production credentials. Never on your daily machine.
What no mode auto-approves
Some safeguards hold in every mode:
- Deny rules block in every mode, even
bypassPermissions. - **Explicit
askrules** still ask. - Questions Claude needs you to answer still come to you.
- Dangerous deletions of critical paths aren't silently approved.
Pick the mode
Start a session where file edits are accepted automatically. Type the full command.
Check your understanding
Which mode denies anything that isn't pre-approved?
Where is bypassPermissions appropriate?
Do deny rules apply in bypassPermissions mode?
What checks actions in auto mode?
Which key cycles modes in the CLI?