Guide

Claude Code auto mode and the permission modes

Harrowtech.ai · last checked 13 October 2026

Claude Code auto mode lets Claude keep working without stopping for routine permission prompts. Instead of you approving each shell command or network request, a second model, which Anthropic calls the classifier, looks at the action first and blocks anything that goes beyond your request, aims at infrastructure it does not recognise, or appears to be driven by hostile content Claude has read.

Is it safe to use? Anthropic does not claim it is safe on its own. Its documentation says: “Auto mode reduces permission prompts but does not guarantee safety. Use it for tasks where you trust the general direction, not as a replacement for review on sensitive operations.” Your own deny and ask rules still apply in auto mode, a short list of actions is never auto-approved in any mode, and an organisation can switch auto mode off. From Claude Code 2.1.283 it is the mode a new terminal or VS Code session starts in when nothing else picks one, so it is worth understanding even if you never chose it.

The six permission modes

A permission mode decides what Claude may do in a session without asking you first. Anthropic's permission modes page sets them out like this; the right-hand column is Anthropic's own wording for what each suits.

The CLI, the VS Code and JetBrains extensions and the desktop app all call the first mode Manual. Its value in settings files and hooks is default, and the CLI accepts manual as another spelling. The VS Code mode indicator labels Accept edits as “Edit automatically”.

Modes are only the baseline. Permission rules sit on top: a deny rule blocks in every mode, bypass included, while allow rules have no effect in bypass mode because everything is already allowed.

What no mode approves on its own

Anthropic lists a few actions that still need a person in every mode, bypass included:

• Any tool matched by an explicit ask rule.
• Connector tools your organisation has set to ask.
• Tools that need your input, such as the built-in AskUserQuestion tool and MCP tools marked as needing user interaction.
• rm and rmdir aimed at a critical path, such as the filesystem root, its top-level folders, your home folder, or your working directory and its parents.
• Reads outside your working directories, when the permissions.blockReadsOutsideWorkingDirectories setting is on.

How auto mode decides

Every action goes through the same order of checks, and the first one that matches settles it:

1. Your allow, ask and deny rules. A matching rule decides at once, with exceptions: a write to a protected path still goes to the classifier even if an allow rule covers it, and no allow rule can approve a critical-path rm.
2. Reads, and file edits inside your working directory, are approved without a check. Writes to protected paths are not, and the first read outside your working directories asks you.
3. Everything else goes to the classifier. In practice that is mostly shell commands and network operations.
4. If the classifier blocks, Claude is given the reason, usually as the name of the rule it matched, such as [Data Exfiltration].

Switching into auto mode also parks any allow rule broad enough to run arbitrary code: Bash(*) or PowerShell(*), wildcarded interpreters such as Bash(python*), package-manager run commands, and allow rules for the Agent and Monitor tools. Narrow rules such as Bash(npm test) keep working. The parked rules come back when you leave auto mode.

When Claude Code sends the classifier request itself, the classifier sees your messages, Claude's tool calls other than read-only lookups, and your CLAUDE.md. Tool results are removed first. Anthropic's reasoning is that hostile text inside a file or web page then cannot work on the classifier directly. Because the classifier reads CLAUDE.md, Anthropic notes that a line such as “never force push” there steers Claude and the classifier together. See CLAUDE.md and projects for how that file is loaded.

Subagents get the same treatment. The classifier reviews the task before a subagent starts, each action while it runs, and its report before the main conversation reads it. A permissionMode line in the subagent's own file is ignored while auto mode is on.

What auto mode blocks and allows by default

Out of the box, the classifier trusts your working directory and the git remotes that were set up when the session started. A remote added or changed during the session is not trusted, and everything else counts as external. On 13 October 2026 Anthropic's page listed 45 kinds of action blocked by default, some added in recent versions. A selection:

• Downloading and running code, for example curl | bash.
• Sending sensitive data to outside endpoints, or printing a live credential or token into the transcript or a file.
• Production deploys and migrations, and terraform destroy or its equivalents in Pulumi, CDK and Terragrunt.
• Force pushes, and commands the classifier assumes would throw away uncommitted work, such as git reset --hard, git clean -fd and git stash drop.
• Irreversibly destroying files that existed before the session started.
• Granting IAM or repository permissions, modifying shared infrastructure, or changing DNS records or TLS certificates.
• Merging a pull request no person has approved, approving Claude's own pull request, or disabling CI checks.
• Running a command with a flag that turns off a safety guard, such as --insecure.
• Commenting out, deleting or forcing through a test that guards security behaviour such as authentication or input validation.

Allowed by default, among others: local file work in the working directory, installing dependencies already declared in your lock files or manifests, reading .env and sending those credentials to the API they belong to, read-only HTTP requests, and pushing to any branch of the repository you are in, including the default branch. A non-default branch whose name marks it as a deploy target, such as production or gh-pages, is judged on its own terms, and what is being pushed is still checked.

To read the full rule text on your own machine, run claude auto-mode defaults, which prints it as JSON.

When auto mode still asks you, or stops

• Ask rules. A tool or command matched by one of your ask rules prompts you, auto mode or not.
• Critical-path deletions. In a terminal you get a prompt with a two-minute countdown. If nobody answers, the command is denied and Claude is told what to do instead; pressing any key stops the countdown. Where no terminal prompt can appear, such as claude -p, the Agent SDK, the VS Code chat panel or the desktop app, the deletion is denied straight away and Claude is told to report what it wanted to delete.
• The first read outside your working directories. Claude Code asks once whether to allow it, and offers to remember the answer. This prompt does not appear in -p runs or background sessions.
• Repeated blocks. After 3 blocks in a row, or 20 in one session, auto mode pauses and normal prompts return. Approving the prompted action turns auto mode back on. Anthropic says these limits cannot be changed. In a -p run with no permission prompt tool there is nobody to ask, so the action is skipped and Claude carries on.

Each blocked action shows a notification and appears in /permissions under the Recently denied tab, where pressing r marks it for a retry.

Limits and permission you give in the conversation

If you tell Claude “don't push” or “wait until I review before deploying”, the classifier blocks matching actions even where its defaults would allow them, until you lift the limit in a later message. Anthropic warns that these limits are not saved as rules. The classifier re-reads them from the conversation each time, so a limit can disappear if context compaction removes the message that set it. For a guarantee, Anthropic's advice is a deny rule.

Permission works the other way, but it has to be specific. The message must name the action and the detail that makes it risky, such as the branch for a force push. Anthropic's own example: “you can force-push” on its own clears nothing. An approval normally covers that one action, not later ones.

The other modes in a little more detail

Manual

Claude Code asks before most actions that edit files, run shell commands or reach the network. A built-in set of read-only commands such as ls, cat and git status runs without a prompt. When you answer “Yes, and don't ask again” to a Bash command, the approval is saved as an allow rule in .claude/settings.local.json at the root of the git repository. A file-edit approval lasts only until the session ends.

Accept edits

Claude creates and edits files in your working directory without asking, and the filesystem commands mkdir, touch, rm, rmdir, mv, cp and sed run without a prompt for paths inside it (or inside folders added with additionalDirectories). Other Bash commands, apart from the built-in read-only set, still prompt. Anthropic suggests this mode when you would rather review the changes afterwards in your editor or with git diff.

Plan

Claude reads files, runs commands to explore and writes a plan, but does not edit your source. When the plan is ready you choose between “Yes, and use auto mode”, “Yes, manually approve edits” and “No, keep planning”. Ctrl+G opens the plan in your text editor first. With auto mode available and the useAutoModeDuringPlan setting on, which is the default, the classifier reviews exploration commands instead of prompting you. The explore-plan-code routine itself is covered in Claude Code best practices.

dontAsk

Anything that would prompt is refused, so the session never waits for input. Reads and pre-approved tools still run. It is never part of the Shift+Tab cycle; you set it with --permission-mode dontAsk or in settings. Cloud sessions ignore it when it comes from a settings file. Anthropic's CI example:

claude -p "run the test suite" --permission-mode dontAsk --allowedTools "Bash(npm test)" "Read"

Bypass permissions

Prompts and safety checks are switched off, and tool calls run immediately, including writes to protected paths such as .git and .claude. Only the short list of actions no mode approves still stops for you. You cannot switch into it from a session that started without it: start with --permission-mode bypassPermissions (or the equivalent --dangerously-skip-permissions), set it as defaultMode in your user settings, or use --allow-dangerously-skip-permissions to add it to the Shift+Tab cycle without starting in it. On Linux and macOS it refuses to run as root or under sudo. The first interactive time, a dialog asks you to accept responsibility, and declining exits Claude Code. Administrators can block the mode with permissions.disableBypassPermissionsMode set to "disable".

Protected paths

Writes to a fixed set of paths are never auto-approved, except in bypass mode and in plan mode in a terminal session where bypass is available. The set includes .git, .vscode, .idea, .husky, most of .claude, shell start-up files such as .bashrc and .zshrc, .npmrc, and .mcp.json. Manual and Accept edits prompt for them, auto mode sends them to the classifier, and dontAsk refuses them. An allow rule in a settings file does not change this.

Which mode a new session starts in

For a session started in a terminal, Claude Code takes the first of these that applies:

1. The --permission-mode flag, or --dangerously-skip-permissions.
2. permissions.defaultMode in a settings file.
3. The built-in default.

The built-in default for an interactive terminal or VS Code session is auto with version 2.1.283 or later. A claude -p run or Agent SDK session starts in Manual when it fetches feature flags; one that does not, for example on a third-party provider or with telemetry off, starts in auto on 2.1.285 or later. If any settings file sets disableAutoMode to "disable", the default is Manual. If auto is chosen but not available to the session, it starts in Manual instead.

One trap: auto and bypassPermissions do not take effect as defaultMode in a project's .claude/settings.json or .claude/settings.local.json. Put them in ~/.claude/settings.json, or pass the flag. Running scripted sessions is covered in Claude Code CLI and headless mode.

How to switch modes

• During a session in the terminal: press Shift+Tab. Anthropic lists Alt+M instead on some Windows set-ups. From auto, the first press goes to Manual, then Accept edits, then Plan. Bypass appears after Plan only if the session was started with it enabled, and auto comes last. The status bar shows the mode, for example ⏸ manual mode on or ⏵⏵ auto mode on.
• From a prompt: on 2.1.247 or later, a Bash permission prompt in Manual or Accept edits can offer “Yes, and switch to auto mode”, which approves the command and changes mode.
• At start-up: claude --permission-mode plan. On 2.1.296, claude --help lists the choices as acceptEdits, auto, bypassPermissions, manual, dontAsk and plan; default also works. The old --enable-auto-mode flag was removed in 2.1.111.
• As your default: set permissions.defaultMode. Anthropic's example, saved in ~/.claude/settings.json, makes every terminal session start in Manual:

{
  "permissions": {
    "defaultMode": "default"
  }
}

Other surfaces have their own controls. In VS Code, click the mode indicator at the bottom of the prompt box; its claudeCode.initialPermissionMode setting does not accept auto. In the desktop app's Code tab, use the mode selector next to the send button. Cloud sessions on claude.ai offer Accept edits, Plan and Auto, and no bypass.

Setting allow, ask and deny rules

Type /permissions in a session to see every rule and the settings file it comes from, and to add or remove rules. Three kinds exist: allow (run without asking), ask (always prompt) and deny (never run). Claude Code checks deny first, then ask, then allow, and the first match wins. How specific a rule is makes no difference, so a broad deny such as Bash(aws *) beats a narrow allow such as Bash(aws s3 ls).

A rule is a tool name, optionally followed by a specifier in brackets:

Anthropic's settings reference gives this example. It approves npm run commands, prompts before git push, blocks reads of .env and starts sessions in Accept edits:

{
  "permissions": {
    "allow": ["Bash(npm run *)"],
    "ask": ["Bash(git push *)"],
    "deny": ["Read(./.env)"],
    "defaultMode": "acceptEdits"
  }
}

Put rules in ~/.claude/settings.json for all your projects, in a project's .claude/settings.json to share them with the team through git, or in .claude/settings.local.json for yourself in one project. Lists from different files are combined, not replaced, and a deny at any level cannot be overruled by an allow somewhere else. Allow rules in a project's shared file only take effect once you accept the workspace trust dialog for that folder; deny and ask rules apply at once.

Because auto mode lets pushes and pull requests through by default, Anthropic suggests ask rules if you want a person to sign off on them while auto mode handles everything else:

{
  "permissions": {
    "ask": [
      "Bash(git push *)",
      "Bash(gh pr create *)"
    ]
  }
}

Two limits to know. First, a Bash rule matches the command as Claude writes it. Bash(git push *) does not catch git -C . push origin main, and Anthropic says such a rule “isn't a security boundary around the program”. For a check on the full command text it points to a PreToolUse hook (see Claude Code hooks), and for enforcement that does not depend on wording, to sandboxing. Second, Read and Edit deny rules cover Claude's file tools and the file commands Claude Code recognises in Bash, but not a Python or Node script that opens the file itself.

Telling auto mode about your own set-up

If auto mode keeps blocking routine work, such as pushing to your company's GitHub organisation or writing to a team storage bucket, the usual fix is the autoMode.environment setting. Entries are plain sentences that the classifier reads, not patterns. Anthropic's example, shortened:

{
  "autoMode": {
    "environment": [
      "$defaults",
      "Source control: github.example.com/acme-corp and all repos under it",
      "Trusted internal domains: *.corp.example.com, api.internal.example.com"
    ]
  }
}

• Keep "$defaults" in the list. Anthropic's warning: setting any of environment, allow, soft_deny or hard_deny without it “replaces the entire default list for that section”. Leaving it out of soft_deny drops the built-in blocks on force push, curl | bash and production deploys.
• The classifier reads autoMode only from ~/.claude/settings.json, managed settings and the --settings flag or Agent SDK. It ignores autoMode in a project's .claude/ files, so a repository cannot add its own allowances.
• autoMode.hard_deny entries block whatever you say; soft_deny entries block unless an allow entry or your specific instruction clears them.
• "classifyAllShell": true inside autoMode sends every shell command to the classifier, even ones your allow rules cover. Anthropic notes the cost: each command waits for a decision.
• /auto-mode-setup drafts environment entries from your project and recent sessions and, if you accept, writes them to ~/.claude/settings.json. It needs a Pro, Max or Team plan and version 2.1.228 or later (2.1.233 on native Windows).
• claude auto-mode config shows the rules in force, claude auto-mode critique reviews your custom entries, and claude auto-mode reset removes your user-level autoMode section.

For actions that must never happen whatever anyone types, Anthropic recommends a permissions.deny rule in managed settings, which is checked before the classifier and cannot be overridden.

Plans, models and versions

• Plans: Anthropic's requirements list for auto mode reads “Plan: All plans”, meaning every plan that includes Claude Code; the free Claude plan has none (see Claude Code pricing). On Team and Enterprise it is on by default, and administrators can turn it off for everyone with permissions.disableAutoMode set to "disable" in managed settings. For plan prices, see Claude Code pricing.
• Models on the Anthropic API and Claude Platform on AWS: Claude Opus 4.6 or later, Sonnet 4.6 or later, Haiku 5.5, or a Fable model.
• Models on Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry and the Claude apps gateway: Sonnet 5 or later, Opus 4.7 or later, Haiku 5.5 and the Fable models. Sonnet 4.5, Opus 4.5, Haiku 4.5 and the claude-3 models are not supported anywhere.
• Versions: auto has been the built-in starting mode for terminal and VS Code sessions on every plan since 2.1.283. Before that it was the starting mode only on Pro, Max and Team plans, and before 2.1.228 (2.1.233 on native Windows) the built-in default was Manual.
• Cost: the classifier runs on Claude Sonnet 5 by default, not on the model you picked. On Enterprise plans, and on accounts using the Claude API, Claude Platform on AWS, Bedrock, Google Cloud's Agent Platform or Foundry, its calls count toward your token usage. Where Anthropic's servers do the review inside the normal model request, there are no separate classifier calls.

If Claude Code says auto mode is unavailable, Anthropic suggests checking those requirements and whether any settings file sets disableAutoMode. Anthropic can also switch it off on its side; a session that gets that answer keeps auto mode off until it ends, so start a new session later.

Safety cautions, in Anthropic's words

“bypassPermissions offers no protection against prompt injection or unintended actions. For background safety checks with far fewer permission prompts, use auto mode instead.”Anthropic, Choose a permission mode

“Only use this mode in isolated environments like containers, VMs, or dev containers without internet access, where Claude Code cannot damage your host system.”Anthropic, on bypass permissions mode

“Permission rules are enforced by Claude Code, not by the model. Instructions in your prompt or CLAUDE.md shape what Claude tries to do, but they don't change what Claude Code allows.”Anthropic, Configure permissions

“You're responsible for reviewing proposed code and commands for safety before approval.”Anthropic, Security

“While these protections significantly reduce risk, no system is completely immune to all attacks. Always maintain good security practices when working with any AI tool.”Anthropic, Security

Which mode for which job

Built only from what Anthropic's permission modes page says each mode is for, including its “Common setups” table.

Harrowtech.ai's AI Setup service sets up coding tools with rules and guardrails, from £720 (1 day); coding tools training is a half-day from £360. See pricing.

What this guide does not cover

It leaves out the Bash sandbox and its settings, the PowerShell tool's own deletion checks, deploying managed settings, the HIPAA configuration, server-side classifier review, the Agent SDK's permission callbacks, cross-session messaging and the separate permission modes in the desktop app's Cowork tab. It also lists only part of the 45 default blocks. Anthropic's pages linked below cover each of these. Features and version numbers change often, so check claude --version against the docs before relying on a detail.

Sources

• Anthropic: Choose a permission mode, read 13 October 2026. Modes table, auto mode decision order, default blocks and allows, fallbacks, start-up order, versions, models, protected and critical paths, common setups.
• Anthropic: Configure auto mode, read 13 October 2026. autoMode settings, $defaults, ask-rule checkpoints, /auto-mode-setup, the claude auto-mode commands.
• Anthropic: Configure permissions, read 13 October 2026. Rule order, syntax, Bash rule limits, Read and Edit rules, workspace trust.
• Anthropic: Settings files and precedence and Settings reference, read 13 October 2026. File scopes, merging lists, permissions.defaultMode, the example rules block.
• Anthropic: Interactive mode, read 13 October 2026. Shift+Tab and Alt+M.
• Anthropic: CLI reference, read 13 October 2026. --permission-mode, the bypass flags, --enable-auto-mode removal.
• Anthropic: Security, read 13 October 2026. Manual mode behaviour and the quoted cautions.
• claude --version and claude --help run on Claude Code 2.1.296 on 13 October 2026.

Related: All Harrowtech.ai guides · Claude Code CLI and headless mode · Claude Code hooks · CLAUDE.md and projects · Claude Code commands and shortcuts · Claude Code best practices