Permission mode determines what Claude Code can do without interactive confirmation, and it is the first lever of trust you hold. The Manual mode in the interface corresponds to the config value default; since version 2.1.200 the CLI also accepts the manual alias. It is important to understand that mode is not about convenience but about a boundary: how much autonomy you give the agent depends on how familiar the code is and how costly a mistake is in this particular work.
There are several modes, and each allows its own set of actions without asking. default (manual) does nothing without asking except reading - the choice for the first run and sensitive work. acceptEdits automatically allows edits and a limited set of ordinary file commands in the workspace - for fast iteration with a subsequent git diff. plan - exploration without changing sources. auto acts after a background check by a separate classifier. dontAsk runs only what was pre-allowed. bypassPermissions - almost everything bypassing the ordinary flow.
Switching modes in the CLI is predictable. Shift+Tab cycles through the available modes, and the base cycle is Manual, Accept edits, Plan. dontAsk is not in this cycle; auto appears only when the account, model and provider requirements are met; bypassPermissions must be separately allowed at launch or in settings. A one-off mode is set with the --permission-mode flag, and a permanent one with the defaultMode key in permissions.
It helps to gather the modes, their autonomy and purpose into a table once, to choose consciously. Below is a map from manual to bypass. You return to it at the start of each task: familiar code and a cheap mistake allow acceptEdits, an unfamiliar task asks for plan, and sensitive work with secrets and production asks for manual. Mode is not a "once and for all" setting but a decision for the context of the specific session.
| Mode | Without asking | Use |
|---|---|---|
| default / manual | Reading only | First run, sensitive work |
| acceptEdits | Edits and file commands in the workspace | Fast iteration + git diff |
| plan | Exploration without changing sources |
| Unfamiliar task, architecture |
| auto | Actions after a classifier check | Long tasks in a trusted area |
|---|
| dontAsk | Only what was pre-allowed | CI and closed scenarios |
|---|
| bypassPermissions | Almost everything bypassing the flow | Only a disposable container/VM |
|---|
What exactly the modes change is worth understanding precisely. acceptEdits auto-allows edits and common file commands like mkdir, rm, mv, cp - but only for paths within the workspace or additionalDirectories; protected paths and other commands keep their restrictions. auto uses a classifier that assesses whether an action went beyond the request and whether it was triggered by hostile content; explicit ask rules still ask. dontAsk simply rejects everything not allowed in advance.
bypassPermissions must not be considered "ordinary auto", and this is the key warning. Even in it explicit deny and ask still apply, the organization may require confirmation for connector tools, and an MCP tool may declare requiresUserInteraction; Claude Code separately protects some root and home deletions. But none of this makes the mode safe for the main working machine. The official recommendation is to use it only in an isolated disposable container or VM with no valuable data; the --dangerously-skip-permissions flag is named dangerous deliberately.
For a team that has not yet set up policy there is a protected baseline. You start with default or plan; add pointed allow rather than a general bypass; enable the sandbox for the shell; leave destructive, deployment and credential actions in ask or deny; and make auto only a user or managed decision - project settings must not raise autonomy on their own. This order gives working speed without opening to the agent what is costly to roll back.
It helps to see once how the mode is set at launch and in settings, so as not to confuse a one-off with a permanent one. Below are --permission-mode examples for plan, acceptEdits and a closed non-interactive run with a narrow allowlist, plus defaultMode in settings. The typical failure is leaving bypass as the permanent default on a working machine or expecting plan mode to prove the plan's correctness itself; the right move is a mode for the context, pointed allow and a sandbox for the shell.
claude --permission-mode plan # exploration
claude --permission-mode acceptEdits # auto-applying edits
# a closed non-interactive run with a narrow allowlist
claude -p "check formatting" --permission-mode dontAsk \
--allowedTools "Read,Grep,Glob,Bash(npm run lint:*)"
# a permanent default - in settings: { "permissions": { "defaultMode": "acceptEdits" } }