Looplane now grades effects as read/modify/modify_execute/execute and fails closed on unclassified tools. Native MCP tools default to execute unless trusted read-only metadata lowers them. Approval events still land in events.jsonl first and grants can scope to one change set or backend; general command rules and universal sandbox coupling remain unfinished.
Looplane applies a non-bypassable critical floor, evaluates user, organization, and project denies before any allows, and keeps execute operations policy-gated even in dangerous mode. This decides authority; it is not an OS sandbox.
Claude Code ships six permission modes; day to day you cycle Manual, Accept edits, Plan, and Auto with Shift+Tab. On Pro/Max/Team plans, eligible interactive terminal and VS Code sessions start in auto mode by default, with a background classifier reviewing most actions and blocking force pushes, `curl | bash`, production deploys, and more by default. This post covers the four-mode spectrum, permission rule syntax, and organization-level trust config.
Claude Code reads settings from five levels — managed settings, CLI flags, project local, shared project, and user — where plain values are overridden by higher levels while list keys like permissions.allow merge across scopes. This guide covers each file's role, the allow/deny/ask rule syntax, and how to verify your settings with /status and claude doctor.
Claude Code has five permission modes: default (confirm each step), acceptEdits (auto-accept edits), plan (read-only planning), auto (background AI classifier review), and bypassPermissions (YOLO, skip everything). Switch with Shift+Tab or configure via settings.json. Auto mode is the sweet spot — no step-by-step confirmations, but with safety guardrails.