Claude Code Permission Modes Explained: Manual, Accept Edits, Plan, and Auto

Claude Code doesn't just suggest code — it edits files and runs commands. Permission modes decide how much of that it does without asking you first. Choosing the right one is the difference between approving forty prompts an hour and letting it work safely while you do something else. This is based on Anthropic's documentation as of September 2026.

The modes

Mode	What runs without asking	Good for
Manual (`default`)	Reading files only	Sensitive work, unfamiliar code, learning
Accept edits (`acceptEdits`)	Reading, file edits, and basic file commands like `mkdir` and `mv`	Iterating on code you're reviewing
Plan (`plan`)	Reading and researching — no edits until you approve a plan	Exploring before a big change
Auto (`auto`)	Everything, with a separate AI classifier reviewing risky actions	Long tasks, fewer interruptions
Don't ask (`dontAsk`)	Only tools you've pre-approved; everything else is refused	Scripts and CI
Bypass permissions (`bypassPermissions`)	Everything, no checks	Isolated containers and VMs only

Manual

Claude asks before editing a file or running a command: "Run npm install? Yes / No." It's slow, but you see everything. Use it while you're learning what Claude Code does, and for anything touching production, payments, or secrets.

Accept edits

File edits go through without prompts; shell commands still ask. A good middle ground when you're watching and will review the changes afterwards. (How to Read a Diff.)

Plan

Claude investigates and writes a plan but can't change files until you approve it. Use it before any significant change — it catches misunderstandings while they're cheap. (Claude Code Plan Mode.)

Auto

A second model — a classifier — reviews actions before they run. Reading and editing files in your project goes through; riskier actions like shell commands and network access are checked, and anything that looks dangerous (deleting important paths, sending data somewhere unexpected) is blocked. When it blocks something, Claude gets the reason and tries another way.

On Pro, Max, and Team plans, recent versions of Claude Code start in auto mode in the terminal and VS Code. Enterprise plans and API-key users start in Manual. Anthropic is clear that auto mode reduces prompts but doesn't guarantee safety — keep reviewing sensitive work yourself.

Don't ask and bypass

Don't ask is for automation: only the exact tools you allowlisted run, and anything else is refused rather than prompting. (Claude Code Headless Mode.)
Bypass permissions (--dangerously-skip-permissions) removes the checks entirely. Only use it inside a disposable container or VM with nothing valuable in reach. (Claude Code's --dangerously-skip-permissions.)

Switching modes

During a session: press Shift+Tab to cycle. The status bar shows the current mode — for example, ⏸ plan mode on or ⏵⏵ accept edits on.
At startup: claude --permission-mode plan (or default, acceptEdits, auto, and so on).
As your default: set permissions.defaultMode in your settings file. (Claude Code Settings Explained.)

Rules: fine-tuning on top of modes

Modes set the baseline. Permission rules adjust it for specific tools and commands. There are three kinds:

allow — run without asking.
ask — always ask, even in auto mode.
deny — never allowed, in any mode, including bypass.

For example, in .claude/settings.json:

{
  "permissions": {
    "allow": ["Bash(npm run test *)", "Bash(npm run lint)"],
    "ask": ["Bash(git push *)"],
    "deny": ["Read(./.env)", "Bash(rm -rf *)"]
  }
}

That lets tests and linting run freely, always asks before pushing, and forbids reading your .env file of secrets. Use /permissions inside Claude Code to view and edit rules. When you click "Yes, and don't ask again" on a prompt, that adds an allow rule.

Deny rules are your hard safety net — they apply no matter which mode you're in.

Which mode should you use?

Brand new to Claude Code? Start in Manual for your first few sessions, even if auto is your default. Watching what it asks to do is the fastest way to learn how it works.
Big or unfamiliar change? Plan first, then switch to accept edits or auto.
Routine work in a project with good tests and Git? Auto or accept edits.
Anything near production data, payments, or credentials? Manual, plus deny rules. (How to Stop an AI Agent From Deleting Your Production Database.)
Unattended automation? Don't ask with an exact allowlist, in an isolated environment.

Permissions aren't isolation

Permission modes decide whether Claude asks. They don't limit what an approved command can reach. A command you approve — or that auto mode allows — runs with your user account's full access to your machine.

That's why the safest setups pair permissions with isolation: run Claude Code in a container or separate workspace where even a bad command can only affect that project. (How to Run AI-Generated Code Safely.)

EasySpawn runs Claude Code in an isolated Docker workspace per project — non-root, resource-limited, with no access to the host — so whichever permission mode you choose, its reach stops at that project. See how it works or join the waitlist.