Claude Code Permission Modes Explained: Five Modes from Default to Auto

🌏 中文版

For the proper tiered approach (each permission mode and auto mode configuration), read Permissions and Auto Mode; this post covers what it costs when you still decide to bypass it all.

TL;DR

Claude Code has five permission modes, from most restrictive to most permissive: plan (read-only) → default (confirm each step) → acceptEdits (auto-accept edits) → auto (AI classifier review) → bypassPermissions (YOLO, skip everything). For most workflows, auto mode is all you need — it uses a background classifier to assess safety automatically and only blocks genuinely dangerous operations. As of week 32 of 2026, interactive sessions on Pro, Max, and Team plans start in auto mode by default.

Mode Overview

Switching Modes

During a Session

In the CLI, press Shift+Tab to cycle through: default → acceptEdits → plan. When your account meets the requirements, auto joins the cycle right after plan; bypassPermissions only appears after you've started with its flag, and dontAsk is never in the cycle — set it with --permission-mode dontAsk.

In VS Code and Claude Desktop, click the mode selector next to the input box.

At Launch

claude --permission-mode plan
claude --permission-mode auto

Set as Default

// .claude/settings.json
{
  "permissions": {
    "defaultMode": "acceptEdits"
  }
}

Plan Mode: Think Before You Act

Plan mode restricts Claude to read-only access — it can analyze your codebase and propose solutions, but cannot modify your source code.

Usage

# Start an entire session in plan mode
claude --permission-mode plan

# Or prefix a single request with /plan
/plan Refactor the authentication module and give me a migration plan

After Planning

Once Claude presents a plan, it will ask how to proceed:

• Yes, and use auto mode — approve the plan and execute in auto mode immediately (falls back to auto-accepting edits when auto mode is unavailable)
• Yes, manually approve edits — approve, then review each edit individually
• No, keep planning — stay in plan mode and refine the plan

Great for getting the full picture before committing to a multi-step implementation:

I want to migrate the auth system from JWT to OAuth2.
Analyze the current implementation and give me a complete migration plan.

Auto Mode: The Sweet Spot

Auto mode is the safe alternative to bypassPermissions (YOLO). It uses a separate classifier model running in the background to evaluate each operation and determine whether it is safe.

Now available on all plans (requires Opus 4.6 / Sonnet 4.6 or later, or Fable 5). It's on by default for Team and Enterprise; admins can turn it off via disableAutoMode in managed settings. As of week 32 of 2026, interactive sessions on Pro, Max, and Team plans start in auto mode by default (CLI v2.1.228+; claude -p and Agent SDK sessions still start in default mode).

How It Works

Each operation is evaluated in a fixed order:

1. Your allow/deny rules → pass or block immediately
2. Read-only operations and file edits within the working directory → automatically allowed
3. Everything else → sent to the classifier
4. Classifier blocks → Claude receives the reason and attempts an alternative

What the Classifier Blocks by Default

Blocked:

• Download and execute code (curl | bash)
• Send sensitive data to external services
• Production deployments and migrations
• Bulk deletion from cloud storage
• Granting IAM / repo permissions
• Modifying shared infrastructure
• Force push, rewriting remote history
• Destructive git operations: git reset --hard, git checkout -- ., git clean -fd, dropping stashes (treated as discarding uncommitted changes)

Allowed:

• File operations within the working directory
• Installing dependencies declared in lock files
• Reading .env and sending credentials to the corresponding API
• Read-only HTTP requests
• Pushing to any branch of the repository you're working in (including the default branch as of v2.1.211; branches named as deploy targets like production or gh-pages are judged separately)

Customizing Classifier Rules

If the classifier is blocking legitimate operations for your team (pushing to your org's repos, writing to your company's bucket), add autoMode.environment in managed settings to tell the classifier these targets are trusted.

Fallback Behavior

If the classifier blocks 3 consecutive operations or 20 total → auto mode pauses and reverts to manual confirmation. After you confirm, the counters reset and auto mode resumes.

Handling Sub-agents

• Before a sub-agent launches: classifier reviews the task description
• While a sub-agent runs: same block/allow rules apply
• After a sub-agent completes: classifier reviews the full operation history

bypassPermissions (YOLO Mode)

--dangerously-skip-permissions is equivalent to --permission-mode bypassPermissions:

claude --dangerously-skip-permissions "Fix all lint errors"
claude --permission-mode bypassPermissions "Fix all lint errors"

The Risk Calculus Has Changed

When this post was first written, manual approval was the only line of defense; auto mode is now the default for interactive sessions on Pro, Max, and Team plans, so an ordinary session already has a background classifier watching it. bypassPermissions therefore no longer means "a few fewer confirmations" — it means skipping that classifier entirely. What you're removing is a safety net that's on by default.

What Gets Bypassed

• All permission prompts
• Command blocklists (curl, wget, etc. are unblocked)
• Write restrictions (not limited to the working directory)
• MCP server trust verification
• Sub-agents inherit full permissions and cannot be overridden

A Real Incident

A developer asked Claude to clean up unused packages in their project. Claude ended up running rm -rf tests/ patches/ plan/ ~/ — that trailing ~/ wiped the entire home directory. Research by eesel AI found that 32% of developers using YOLO mode have experienced unintended file modifications, and 9% have suffered data loss.

Three Safety Levels

Level 1: Git Checkpoint

git add -A && git commit -m "Checkpoint pre-Claude"
claude --dangerously-skip-permissions "Refactor all API handlers"
# If something goes wrong
git reset --hard HEAD

Level 2: Restrict Dangerous Tools

claude --dangerously-skip-permissions \
  --disallowedTools "Bash(rm:*),Bash(curl:*),Bash(wget:*)" \
  "Refactor all API handlers"

Level 3: Docker Isolation (Safest)

docker run --rm \
  --network none \
  -v $(pwd):/workspace \
  my-dev-container \
  claude --dangerously-skip-permissions "Fix all lint errors"

YOLO vs Auto Mode

Bottom line: use auto mode when you can, and only fall back to YOLO in Docker. If you genuinely need YOLO, run it inside a container.

dontAsk Mode: Allowlist Only

dontAsk automatically rejects all tools that are not explicitly permitted. Ideal for CI pipelines or locked-down environments:

claude --permission-mode dontAsk

Pair with settings.json for precise control:

{
  "permissions": {
    "allow": [
      "Read",
      "Write(src/**)",
      "Bash(npm test)",
      "Bash(npm run lint)"
    ]
  }
}

Fine-Grained Control with settings.json

Regardless of which mode you use, you can layer additional rules via the permissions config:

{
  "permissions": {
    "defaultMode": "acceptEdits",
    "allow": [
      "Read",
      "Write(src/**)",
      "Bash(git *)",
      "Bash(npm *)",
      "Bash(tsc:*)"
    ],
    "deny": [
      "Read(.env*)",
      "Write(production.config.*)",
      "Bash(rm *)",
      "Bash(sudo *)"
    ]
  }
}

This configuration can be committed to the repo so the whole team shares the same security baseline. Override personal settings with .claude/settings.local.json.

Mode Comparison Summary

References

• Claude Code - Permission modes
• Claude Code - Configure auto mode
• Claude Code - Permissions
• Auto Mode Announcement
• claude --dangerously-skip-permissions - PromptLayer
• YOLO Mode Hidden Risks | UpGuard

Changelog

• 2026-08-26: Fact refresh — updated the risk comparison now that auto mode is the default permission mode on Pro/Max/Team, and added series cross-links.