Claude Code's permission mode decides which actions run without asking you. default (shown as Manual) asks before edits and shell commands. acceptEdits also lets file edits and common file commands through. plan lets Claude read and propose a plan but not edit. auto lets a background classifier approve actions instead of you. dontAsk denies anything that would prompt. bypassPermissions, which --dangerously-skip-permissions turns on, skips prompts almost entirely and is meant only for isolated containers or VMs. Press Shift+Tab to cycle modes, or start with claude --permission-mode <mode>.
This guide is based on Anthropic's permission modes documentation. Claude Code changes often, so check there for the version you run.
01The six modes at a glance
default (Manual)Reads onlyReviewing every action, sensitive workacceptEditsReads, file edits, and common filesystem commands such as mkdir, touch, mv and cp inside the working directoryIterating on code you are watchingplanReads; edits are blocked until you approve the planExploring before changing anythingautoEverything, with a classifier checking each action firstLong tasks with fewer promptsdontAskReads in the working directories and pre-approved tools; everything else is deniedCI and locked-down scriptsbypassPermissionsEverything, with a few exceptionsIsolated containers and VMs onlydefault is the name used in settings, hooks and the --permission-mode flag. The CLI, the IDE extensions and the desktop app label it Manual, and the CLI accepts manual as an alias.
02How to switch modes
In the terminal, press Shift+Tab. The cycle runs default, acceptEdits, plan, then any optional modes your session allows. dontAsk never appears in the cycle; you set it only with the flag.
To start a session in a mode:
claude --permission-mode planTo make a mode your default, set it in ~/.claude/settings.json:
{
"permissions": {
"defaultMode": "acceptEdits"
}
}The flag wins over the setting, and the setting wins over the built-in default. One restriction is worth knowing: auto and bypassPermissions do not take effect from a project's .claude/settings.json or .claude/settings.local.json. A repository cannot quietly put you in bypass mode. Set those two in your user settings, or pass the flag.
What a new session starts in
Recent versions of Claude Code (v2.1.283 or later) start interactive terminal and VS Code sessions in auto when auto mode is available, unless your settings say otherwise. claude -p and Agent SDK runs start in default. If you have never chosen a mode and wonder why you see so few prompts, this is why.
03The modes in more detail
default (Manual)
Claude can read files without asking. Edits, shell commands and network access each show a prompt. On a Bash prompt, "Yes, and don't ask again" saves an allow rule to .claude/settings.local.json so that command does not ask again in this repository. File edit approvals last until the session ends.
acceptEdits
Edits and simple file commands (mkdir, touch, rm, rmdir, mv, cp, sed) inside your working directory run without a prompt. Other shell commands still ask. A good middle ground when you are watching the diff as it happens.
plan
Claude explores with reads and read-only commands, then presents a plan. Nothing in your source is edited until you approve it. Use it for unfamiliar code or risky changes.
auto
A separate model reviews each action before it runs and blocks ones that go beyond your request, target infrastructure it does not recognise, or look driven by hostile content. Explicit ask rules still prompt. If the classifier blocks three actions in a row or twenty in a session, auto mode pauses and normal prompting resumes. Anthropic's own wording is that auto mode "reduces permission prompts but does not guarantee safety."
dontAsk
Anything that would prompt is denied. Only allow rules and actions that never need approval run. It exists for scripts and CI, where there is nobody to answer.
bypassPermissions and --dangerously-skip-permissions
--dangerously-skip-permissions is the same as --permission-mode bypassPermissions. Prompts are skipped, including for writes to protected paths such as .git and .claude. A few things still prompt or are denied in every mode, including explicit ask rules, AskUserQuestion and some dangerous rm commands. Deny rules still block.
Anthropic's guidance is to use it only in containers, VMs or dev containers without internet access. On Mac and Linux, Claude Code refuses to start in this mode as root or under sudo outside a recognised sandbox. If you only want bypass available, not on, --allow-dangerously-skip-permissions adds it to the Shift+Tab cycle without switching to it.
04Rules sit on top of modes
Modes set the baseline. Permission rules in settings fine-tune it:
{
"permissions": {
"allow": ["Bash(npm run test *)"],
"ask": ["Bash(git push *)"],
"deny": ["Read(./.env)"]
}
}Rules are checked in the order deny, then ask, then allow, and the first match decides. Deny rules block in every mode, including bypassPermissions. Allow rules have no effect in bypassPermissions, because everything is already allowed there. Run /permissions to see every rule and the file it came from.
Hooks can also take part. A PreToolUse hook can block a tool call in any mode. A PermissionRequest hook can answer a prompt for you, but it cannot override a deny rule. The PermissionRequest guide shows how.
05Choosing a mode when you step away
The usual reason people reach for --dangerously-skip-permissions is that they want to leave Claude running and not come back to a session stuck on a prompt. That is a real problem, but bypass mode solves it by removing your oversight entirely, on your own machine.
Some safer combinations:
- Allow rules for the boring commands. Add your test, lint and build commands to
allow, keepaskongit pushand deploys, and stay indefaultoracceptEdits. - auto mode for long tasks where you accept a classifier's judgement on routine actions.
- Get the prompt to wherever you are. Keep a mode that asks, and answer the few prompts that matter from your phone.
The last one is what Claude Code Notifier does. It is an independent tool, not made by Anthropic. Its command line tool, ccn, runs as Claude Code hooks on Mac, Windows and Linux. When Claude Code is about to ask for permission and you are away from the keyboard, the request goes to your paired iPhone or Android phone, where you can allow once, allow for the session, or deny. It only sees prompts Claude Code was going to show anyway, so the mode and your rules still decide what needs asking. In auto mode you get fewer requests; in bypassPermissions you get none, though "Claude has finished" alerts and questions still arrive. The phone approval guide covers the setup, and Is it safe to approve from your phone? covers the risks.
06FAQ
What is the difference between default and acceptEdits?
default asks before every file edit and shell command. acceptEdits lets file edits and common file commands such as mkdir, mv and cp inside the working directory run without asking. Other shell commands still prompt in both.
Is --dangerously-skip-permissions the same as bypassPermissions?
Yes. The flag is equivalent to --permission-mode bypassPermissions. Anthropic recommends it only in isolated containers or VMs, ideally without internet access.
How do I make Claude Code stop asking for permission for one command?
Choose "Yes, and don't ask again" on the prompt, or add an allow rule such as "Bash(npm test)" under permissions.allow in your settings. This is safer than changing the whole mode.
Can a project's settings put me in bypassPermissions mode?
No. bypassPermissions and auto in .claude/settings.json or .claude/settings.local.json do not take effect. They only apply from user or managed settings, or from the command line flag.
Do hooks still run in bypassPermissions mode?
Yes. Hooks run in every mode, and a PreToolUse hook that denies a tool call blocks it even in bypassPermissions. A PermissionRequest hook only runs when there is a prompt to answer, so in bypass mode it rarely fires.