Permission modes
Claude Code has 6 permission modes, not the 3 most guides teach. Here is what each one lets through, and which to use when a job runs for an hour without you.
The first real question about Claude Code is not what it can do. It is what it is allowed to do to your files.
Most guides answer that with 3 modes: ask first, accept edits, or turn the safety off. There are 6, and 1 of the 3 missing ones is the one you want when a job is running for an hour without you.
The good news is that the default is the careful one, and you change it with a single keypress.
- All 6 permission modes, and what each one lets through without asking
- The 1 keypress that switches between them mid-session
- Which mode to use for reviewing, for iterating, and for a long unattended run
- The actions no mode will ever auto-approve, including bypass
- Protected and critical paths, and why deny rules outrank everything
And I'll go through all 6, starting with the one you are already in.
What is a permission mode?
A permission mode is the baseline for what Claude Code can do without stopping to ask you.
It is not a setting you configure once and forget. You switch it during a session as the work changes: careful while you are reviewing, looser while you are iterating, locked down when something else is running it.
Modes set the baseline. Permission rules layer on top to pre-approve or block specific tools, and a deny rule blocks in every mode, including the one that skips all checks.
The 6 modes
The name you see and the name a settings file wants are not the same, so both are below. The label is what the mode picker shows you; the value in backticks is what you type into a config or a flag.
Manual, config value default. Reads only. Everything else asks. This is where you start, and it is the right mode for anything sensitive.
Accept edits, acceptEdits. Reads, file edits, and common filesystem commands like mkdir, touch, mv and cp. For iterating on work you are watching. The VS Code extension is the one place that labels this Edit automatically, and it is the same mode.
Plan, plan. Reads, plus classifier-approved commands where auto mode is available. For letting it look around before it changes anything.
Auto, auto. Everything, with background safety checks. This is the one the 3-mode guides miss, and it is what you want for a long task rather than turning safety off entirely.
Don't ask, dontAsk. Only pre-approved tools, everything else auto-denied. It is not in any mode picker, so you will not find it by looking: you set it on the command line with --permission-mode dontAsk. For scripts and CI, where a prompt nobody sees is a hang.
Bypass permissions, bypassPermissions. Everything, no checks. The docs are blunt about the scope: isolated containers and VMs only.
Pro tip. A settings file cannot put a cloud session into bypass or don't ask. Those 2 values are ignored there, silently.
Switching mid-session
In the terminal, press Shift+Tab. The cycle runs Manual, then Accept edits, then Plan, then back.
The status bar tells you where you are: ⏸ manual mode on, ⏵⏵ accept edits on, ⏸ plan mode on.
Two modes are not in that cycle by default. bypassPermissions only appears if you started the session in a way that puts it there, and dontAsk never appears at all, which is why the flag is the only way to reach it.
In VS Code and the desktop app it is the mode indicator at the bottom of the prompt box rather than a keypress, and you can pick a mode by its number.
In the VS Code extension there is a catch worth knowing: picking Manual, Edit automatically or Auto is remembered for your next conversation. Picking Plan or Bypass permissions applies to that conversation only, so a session you thought was still in Plan will not be.
One thing that does not work, and people try it constantly: asking Claude in chat to change the permission mode. It is a control, not a request.
Pro tip. Switching mid-check is safe. Claude Code drops a verdict your new mode would not have asked for, and prompts you instead.
Which one I actually use
Auto, for most things.
It approves what passes its safety check and stops for anything risky, which is the behaviour people are reaching for when they turn permissions off entirely. You get through a long task without babysitting it and it still pauses at the parts worth pausing at.
Accept edits earns its place when you are working through a specific file and every prompt is the same yes. And Manual is right the moment the work touches something you would not want changed by accident.
The point is that these are session controls, not a preference you set once. Shift+Tab exists because the right answer changes 3 times in an afternoon.
What no mode will auto-approve
Bypass does not mean bypass everything, and this is the part worth knowing before you trust it.
Claude Code never auto-approves anything matched by an explicit ask rule, any tool that needs you (like a question it asks you directly), or rm and rmdir targeting a critical path. That last one cannot be approved by an allow rule or a hook either.
So the floor is higher than the name suggests. But that is a floor, not a safety net, and the docs still scope bypass to isolated machines.
Watch out. That floor is not a safety net. It blocks rm against a critical path, not against the folder you happen to be standing in.
Rules beat modes
A deny rule blocks in every mode, including bypassPermissions.
An allow rule does the opposite: it has no effect in bypassPermissions, because there is nothing left to allow.
Writes to protected paths are never auto-approved except in bypass, or in a plan-mode session where bypass is already available.
So if there is 1 thing you want never touched, a deny rule is the way to say it. Putting it in CLAUDE.md is a request. A rule is enforcement.
What to do next
- Stay in Manual until you trust a given kind of job
- Learn
Shift+Tab, because switching mid-session is the point - Use Accept edits while you iterate, not as a permanent setting
- Use Auto for long unattended runs, rather than reaching for bypass
- Write a deny rule for anything you never want touched
- Keep bypass for a container or a VM, which is what the docs say it is for
Permission mode questions
The nervous ones first, then the practical ones.
Permission modes are the baseline for what Claude Code can do without asking you first. There are 6: Manual, Accept edits, Plan, Auto, don't ask, and Bypass permissions.
Manual is the default and allows reads only.
Press `Shift+Tab` in the terminal to cycle through them, and the status bar shows which one is active.
Asking Claude in chat to change mode does not work. It is a control you operate, not something you request.
Manual while you are reviewing, Accept edits while you are iterating on work you are watching, and Auto for a long task running without you.
Most people reach for bypass when auto is what they actually wanted.
The docs scope it to isolated containers and VMs, and that is the honest answer.
It is not quite everything: deny rules still block, `rm` against a critical path is still refused, and tools that need your input still ask. But treat that as a floor, not protection.
They are the same mode. Manual is the name you see in the CLI, the extensions and the desktop app; `default` is the config value that hooks and the SDK use.
The CLI accepts `manual` as an alias, so `claude --permission-mode manual` works.
Auto runs everything with background safety checks, and it is the mode most 3-mode guides leave out.
It is the one to use for a long task where prompt fatigue is the real problem, instead of turning permissions off completely.
Yes, with a deny rule. Deny blocks in every mode, including bypass.
Writing "never edit this" in `CLAUDE.md` is a request that Claude can miss. A deny rule is enforcement.
Because it only joins the cycle if you started the session in a way that puts it there, such as `--permission-mode bypassPermissions`.
`dontAsk` never appears in the cycle at all and has to be set with a flag.
Not what Claude reads at launch. Your CLAUDE.md and context files load the same way in every mode.
They affect what it may change. In Manual it will ask before editing any of those files; in accept edits it will not.