Permission Modes for Agents

From 'confirm every action' to auto mode: permission modes determine how often an agent asks you for approval before doing something.

The core problem

An agent that can change files, run commands, or make network requests needs rules: what can it do without asking, and what needs your approval first? These rules are called permission modes.

The main modes in Claude Code

Manual (default): Only reading is allowed; every file change and every command is confirmed beforehand.
Accept Edits: File edits and simple filesystem commands (e.g. creating a folder) run without asking, everything else still gets confirmed.
Plan mode: The agent may only research and write a plan, no changes — good for exploring before actually building.
Auto mode: Almost everything runs without asking; a separate check model in the background blocks risky actions (e.g. production deploys, force pushes).
Bypass Permissions: All checks are off — meant only for isolated environments like containers without internet access.

How to switch

On the command line you cycle between modes with Shift+Tab, or start directly with a flag like --permission-mode plan.

The rule of thumb

As few permissions as possible, as many as necessary (principle of least privilege). For sensitive work or unfamiliar code: manual mode. For routine changes you'll review via diff afterward anyway: Accept Edits. Bypass Permissions only in a real sandbox, never on your actual machine.

EXAMPLE

Start with "claude --permission-mode plan" for a new, unfamiliar codebase. The agent explores and proposes a plan. Only after you approve it do you switch (for example) into Accept Edits mode so it can actually write the changes — without you having to confirm every single file edit individually.

🛠️ EXERCISE — TRY IT YOURSELF

Deliberately switch between two permission modes in a running Claude Code session and observe the difference.

Start Claude Code in a test project in the default mode (manual) and ask for a small code change — observe the confirmation prompt.
Switch with Shift+Tab into Accept Edits mode and ask for the same kind of change — compare what now runs without asking and what still gets confirmed.
Switch into plan mode and ask for a bigger change — verify that no file actually changes until you approve the plan.

✅ SELF-CHECK

☐ Could you name which actions ran automatically in Accept Edits mode and which still needed confirmation?
☐ Did you understand why plan mode changes nothing even though the agent reads files and runs commands?
☐ Do you know why Bypass Permissions only makes sense in an isolated environment?

QUICK QUIZ

What is the rule of thumb when choosing a permission mode?