Control How Much Autonomy Claude Code Gets with 6 Permission Modes

TL;DR Press Shift+Tab to cycle between default, acceptEdits, plan, and auto. bypassPermissions (YOLO mode) still needs a flag. Combine with /permissions to pre-allow specific tools. Most people only know two of the six modes — and confuse what acceptEdits actually approves.

This is one of those essential features that gets overlooked because it looks simple — a keyboard shortcut that cycles modes. But the decision of which mode to use when changes how you work with Claude Code fundamentally. And there's a common misconception: acceptEdits does NOT approve everything. It approves file edits and basic filesystem commands. All other Bash commands still prompt.

Six modes, from most restrictive to most autonomous. Each one is a different tradeoff between oversight and flow.

Result:

> Shift+Tab

default  →  acceptEdits  →  plan  →  auto  →  [bypassPermissions]
                                       ↑              ↑
                                 the built-in   --dangerously-skip
                                 default on     (containers only)
                                 Pro/Max/Team

The six modes

1. default — Review everything

default — ask before every edit

Claude reads files freely but asks before every edit and every command. Use this when you're starting out, working on sensitive code, or don't trust the direction yet.

2. acceptEdits — Trust the edits, review the commands

acceptEdits — edit freely, ask for commands

Claude creates and edits files without prompting. Also auto-approves common filesystem commands: mkdir, touch, rm, rmdir, mv, cp, sed. All other Bash commands still ask.

The misconception: many people think acceptEdits means "approve everything." It doesn't. npm test, git push, curl — all still prompt. If you want to skip those prompts for specific commands without going full auto, you can set up deny rules and allow wildcards to fine-tune what Claude can touch.

3. plan — Look but don't touch

plan — research and propose, never touch files

Claude explores the codebase and proposes a plan. No source edits. Permission prompts still apply for commands. Enter with Shift+Tab or prefix a single prompt with /plan.

When the plan is ready, Claude asks how to proceed: approve and switch to auto, approve and accept edits, approve and review manually, or keep refining.

For the deep dive — the five approval options, Ctrl+G to edit the plan in your editor, the defaultMode: "plan" per project, and the combo with /evaluate before and after — see Plan Mode doesn't make Claude smarter, it forces you to think.

4. auto — Claude decides what's safe

auto — background classifier checks every action

A separate classifier evaluates each action before it runs. Safe operations execute silently. Risky ones (deploys, mass deletion, force push, curl | bash) are blocked.

Requirements: every plan, Pro included. On the Anthropic API and Claude Platform on AWS, Opus 4.6 or later, Sonnet 4.6 or later, or Fable 5. On Bedrock, Agent Platform, and Foundry, only Sonnet 5, Opus 4.7 or later, and Fable 5. It's available on every provider.

On Pro, Max, and Team it's the mode new sessions start in, as of v2.1.228. On Enterprise, on a Console API key, or on the third-party providers, you start in manual mode and reach auto by cycling with Shift+Tab, with no confirmation prompt anymore.

For the classifier internals, conversational boundaries, and dropped allow rules, see Escape Claude Code's permission fatigue without going YOLO. For the brakes it added later (destructive git, a blind rm -rf, and transcript tampering), see Claude Code auto mode now protects you from yourself. And to write rules of your own alongside the built-in ones, see Claude Code auto mode rules: write your own in one plain sentence.

5. dontAsk — Only pre-approved tools

dontAsk — everything denied unless explicitly allowed

Only tools matching your permissions.allow rules execute. Everything else is denied without prompting. Designed for CI pipelines and locked-down scripts. If you're building skills that need to pre-approve their own tools without user intervention, allowed-tools in the skill frontmatter does the same per-skill.

claude --permission-mode dontAsk

Never appears in the Shift+Tab cycle — set it at startup only.

6. bypassPermissions — YOLO mode

bypassPermissions — everything runs, no safety net

Disables all permission prompts and safety checks. Only writes to protected paths (.git, .zshrc, .claude) still prompt.

claude --dangerously-skip-permissions
# or equivalently:
claude --permission-mode bypassPermissions

Use only in containers, VMs, or sandboxed environments. No protection against prompt injection. No classifier. No guardrails. If you run this on your host machine, Claude can rm -rf ~/ and it will execute. If you want that no-prompt flow but contained on your own machine, the OS-level sandbox raises an operating-system wall instead of removing the guardrails.

It also has a side effect you won't see coming: a session in this mode holds messages sent to it by your other sessions until you approve each one by hand. The full rule is in messaging between sessions.

To add YOLO to the Shift+Tab cycle without activating it immediately:

claude --allow-dangerously-skip-permissions

I switched from YOLO to auto mode the day Auto shipped — most of YOLO's flow with a real safety net. See Escape Claude Code's permission fatigue without going YOLO for the full story.

Combine modes with /permissions

Modes set the baseline. /permissions lets you layer specific exceptions on top — pre-approve tools you run constantly so they never prompt, regardless of mode.

> /permissions
# Add allow rules like:
Bash(npm test)
Bash(git add *)
Bash(git commit *)

This is how you stay in default mode for safety but skip the prompt for your most common commands. The rules carry over between sessions and apply in every mode except bypassPermissions (which skips the permission layer entirely).

Building this list by hand is slow. If you'd rather have it written for you from your actual usage history, an official skill builds the allowlist for you.

Reference

How to enter each mode

In the VS Code extension panel you switch modes by clicking the indicator at the bottom of the prompt, not with Shift+Tab. In JetBrains the plugin runs in the integrated terminal, so you keep cycling with Shift+Tab.

Modes control how much autonomy you grant Claude. How well Claude uses that autonomy depends on how you write the prompt. The 5 rules Anthropic recommends for structuring a prompt are orthogonal to mode and apply across all of them.

All of this is for the interactive session, where somebody is there to press a key. In claude -p nobody is, and the same modes behave differently without telling you.

Official docs: Permission modes | Permissions reference