Claude Code permission modes: plan mode, auto mode and when to use each

Manual, accept edits, plan, auto and bypass explained: what each mode allows, how to switch with Shift+Tab, what auto mode blocks, and permission rules that help.

8 minutes Matěj Žalmánek 2026-10-26

How much should an AI agent be allowed to do without asking? Ask too often and you spend the day clicking “yes”. Ask too rarely and one bad command costs you a database. Claude Code answers this with permission modes: from approving every edit, through plan mode, to auto mode with a safety classifier. Here is what each mode does, how to switch between them, and which one to use when.

1. Claude Code permission modes at a glance

2. How to switch permission modes

In a session, press Shift+Tab to cycle through the modes; the status bar shows the current one, such as ⏸ plan mode on or ⏵⏵ auto mode on. To start in a specific mode:

claude --permission-mode plan
claude --permission-mode acceptEdits
claude --permission-mode auto

And to set your default for every session, in ~/.claude/settings.json:

{
  "permissions": {
    "defaultMode": "acceptEdits"
  }
}

Note that a project's .claude/settings.json cannot switch everyone into auto or bypass — those values are ignored there, so a cloned repository cannot quietly turn off your approvals.

3. Plan mode: think first, edit later

In plan mode Claude reads, searches and analyzes, then presents a plan — but does not change your files until you approve it. Enter it with Shift+Tab, by starting a single prompt with /plan, or with claude --permission-mode plan.

When the plan is ready, you choose: Yes, and use auto mode, Yes, manually approve edits, or No, keep planning. Press Ctrl+G to open the plan in your editor and change it before approving.

Plan mode is the cheapest way to catch a wrong approach. Reading a ten-line plan takes a minute; reverting a wrong implementation across twenty files takes an afternoon.

4. Auto mode: what it allows and what it blocks

In auto mode, Claude acts without asking while a classifier reviews each action in the background and blocks the risky ones. By default it lets through things like local file operations in the project, installing dependencies declared in your lock files, read-only HTTP requests and pushing to branches of the repository you work in. It blocks things like:

• downloading and running code (curl … | bash);
• sending sensitive data to outside endpoints;
• production deploys and migrations;
• force push, git reset --hard, git clean -fd;
• merging a pull request no human approved;
• irreversibly deleting files that existed before the session.

When it blocks several actions in a row (three consecutive or twenty in total), auto mode pauses and Claude Code goes back to asking you. Blocked actions are listed under /permissions → Recently denied. Entering auto mode also drops broad allow rules such as Bash(*), so they cannot bypass the classifier.

Auto mode needs a recent model — older ones are not supported — and in recent versions it is the built-in starting mode for interactive sessions. Anthropic's own docs put it plainly: it reduces permission prompts but does not guarantee safety.

5. Bypass permissions: only in a sandbox

bypassPermissions (also --dangerously-skip-permissions) runs everything without any check. Use it only in an isolated container or VM, ideally without internet access — never on your laptop with your SSH keys and production credentials. Claude Code refuses it when running as root outside a recognized sandbox, and even here some things still ask: explicit ask rules and removals of critical paths.

6. Permission rules: allow, ask, deny

Modes set the overall level; rules fine-tune it. In settings:

{
  "permissions": {
    "allow": ["Bash(npm test)", "Bash(npm run lint)"],
    "ask":   ["Bash(git push *)"],
    "deny":  ["Bash(rm -rf *)", "Read(./.env)"]
  }
}

• allow pre-approves matching tools, so you are not asked about npm test fifty times a day;
• ask forces a prompt — even in auto mode;
• deny blocks in every mode, including bypass.

Keep allow rules narrow. Bash(npm test) is fine; Bash(*) is the same as no permissions at all.

7. Which permission mode to use

• New or unfamiliar codebase: plan mode, then manual approvals for the first changes.
• Everyday work in a project you know, with git and tests: accept edits or auto mode, plus narrow allow rules for your usual commands.
• Anything touching production, money or user data: plan mode and manual approvals, with deny rules for the dangerous commands.
• Unattended runs: a container with bypass, or don't-ask mode with an explicit allow list.

8. Approving from your phone with coden

The real cost of careful modes is that you have to sit next to the agent to answer it. coden removes that: the agent runs Claude Code on your computer in manual mode or plan mode, and every permission request — and every finished plan — arrives on your phone. You approve or reject with one tap, wherever you are, and grant a lasting permission for actions you have come to trust. You keep the safety of asking without being tied to the desk.

Do you see it differently? Write to support@coden-app.com.