Claude Code has six permission modes, from asking about nearly everything to asking about nothing. Default (shown as Manual) allows reads only. Plan explores without editing. Accept edits allows file edits. Auto uses a classifier. DontAsk denies anything unapproved. Bypass allows everything and belongs only in isolated environments.
The modes
From Anthropic's permission modes documentation:
| Mode | Runs without asking | Best for |
|---|---|---|
| default | Reads only | Sensitive work, reviewing each action |
| acceptEdits | Reads, file edits, common filesystem commands | Iterating on code you review |
| plan | Reads, plus classifier-approved commands when auto mode is available | Exploring before changing |
| auto | Everything, with background safety checks | Long tasks, fewer prompts |
| dontAsk | Reads inside working directories and pre-approved tools | Locked-down CI |
| bypassPermissions | Everything | Containers and VMs only |
The docs note the mode that reviews every action is called Manual in the interface, while its config value is default.
Switching modes
In the CLI, press Shift+Tab to cycle. From auto, the first press goes to default, then acceptEdits, then plan. The status bar shows which mode is active. You can set a starting mode, but the docs say a value of auto or bypassPermissions placed in project settings files does not take effect, which stops a repository from switching a developer into a looser mode.
What stays gated in every mode
Some things are never auto-approved, even in bypass: tools matched by an explicit ask rule, tools that need user interaction, and writes to protected paths outside the bypass case. Deny rules block in every mode, including bypass, while allow rules have no effect in bypass.
That is the useful lesson. Deny rules are the one control that survives the loosest mode, so put your hard limits there.
Choosing for common jobs
- Reviewing an unfamiliar repository: default, with the sandbox on.
- Understanding code before a change: plan.
- A refactor you will review in a diff: acceptEdits.
- A long unattended task on your machine: auto, with deny rules for what must never happen.
- CI: dontAsk plus a narrow allow list.
- Fully unattended in a throwaway container: bypassPermissions, as a non-root user.
Admin controls
Organizations can block the loosest mode. The docs describe a managed setting, permissions.disableBypassPermissionsMode, set to disable, and a way to turn auto mode off.
Quick check
Do deny rules still apply in bypassPermissions mode?
Yes. The documentation says deny rules block in every mode, including bypass.
Which mode suits locked-down CI?
dontAsk. It denies anything that would prompt unless a permission rule allows it.
Sources
Last reviewed: 19 October 2026.
