The permission mode is the one setting that decides how often Claude Code stops working to ask you for approval. Today we go through what separates the modes from each other, how to tell which one you are in right now, and how to match it to the kind of work in front of you.
There is also a reason the timing is good. From 14 August 2026, new Claude Code sessions on the Pro, Max and Team plans start in auto mode rather than in manual, the most cautious one. Set nothing yourself and your default changes without you doing anything about it – better to know what that means than to work it out from Claude Code having gone quiet.
A permission mode governs the questions, not the capabilities
Claude Code can do exactly the same things in every mode – the mode only decides when it stops to ask you first. That is worth stating plainly, because the name suggests a ladder of capabilities and it isn’t one.
Reading files needs no approval in any mode, and nothing changes that. The differences start with two things: edits to files, and commands run in the terminal. The looser the mode, the more of those go through without a pause.
The second point is just as simple and gets missed as often: you don’t change the mode by asking for it in the chat. Typing “switch to auto” does nothing, because this is the one setting Claude Code doesn’t set for itself – which is right, given that it governs what it has to ask you about. The switch stays on your side.
Shift+Tab, the switch within reach
Changing the permission mode doesn’t take a trip into /config – a keyboard shortcut is enough. The mode gets changed often enough during a working session that it earned one, which is the whole answer to why it is worth knowing. Each press of Shift+Tab moves you to the next of four modes, whose names we take apart in the next section: manual, accept edits, plan and auto. You start from the one you are already in, so the order depends on where you began – keep pressing until you see the one you want.
The label with the mode name changes with every press, so if you overshoot by one, press the shortcut a few more times. That label in the bottom left corner is the only reliable way to check which mode you are in – don’t infer it from whether Claude Code happened to ask you something.
The shortcut and the /config panel do two different jobs, and they are easy to confuse. The shortcut changes the mode for this one conversation, the one you are having now. In /config, under Default permission mode, you set the default: the mode Claude Code starts every new session in. Next time it will open in that default rather than in whatever mode the last conversation ended in. That is deliberate: if a looser mode stuck around permanently after one press, you would have no idea where you stood at the next launch.
The default lives in a settings file, so instead of opening the panel you can simply ask for the change:
I want to set the permission mode Claude Code starts in permanently. First tell me which one I have now and what the possible values are, then propose a change – but don't make it until I approve.The four modes you will meet
These are the four permission modes you get by pressing Shift+Tab, and they are the ones you choose between day to day. What separates them is a single thing: where the work Claude Code does without asking comes to an end.
Manual
Manual is the most cautious mode, and the default until 14 August 2026. Only reading goes through unannounced – every file edit and every command waits for your approval. The status bar at the bottom of the screen shows a grey manual mode on while you are in it.
Accept edits
Accept edits lets file changes through, along with a handful of basic operations on them: creating a directory, moving or copying a file. The scope is narrower than that suggests: automatic approval stops at your working directory, and anything outside it, plus every other command, still needs your say-so. This is the mode for work you review afterwards anyway, instead of approving it line by line.
Auto
Auto works differently from the two above, because it has no fixed list of operations it permits. Before anything runs, a separate model – a classifier – judges it, and its job is to stop actions that can’t be undone, that point outside your own environment, or that reach past what you asked for. Sending data somewhere external, destroying things that existed before the conversation started, deploying to production: those are the kinds of thing it holds back by default. Anthropic says plainly about this mode that it reduces the number of prompts without being a guarantee of safety.
Auto also does something more useful than it sounds: a boundary you state in the conversation is honoured. Write “don’t send anything anywhere until I’ve checked it” and the classifier blocks matching actions even where its own rules would have allowed them. The boundary holds until you lift it, with one caveat worth remembering on longer jobs: it isn’t stored as a rule, so it can be lost when the conversation gets summarised along the way.
Plan
Plan sits slightly apart from the rest, because it isn’t about convenience but about a different stage of the work. Claude Code changes nothing in it: it reads, gets its bearings and puts a plan in front of you, and you decide whether to approve it. Approving it moves the session into a mode where those changes can happen, so plan isn’t a setting you leave switched on – it is something you reach for before a bigger job. What that looks like from the inside is in our lesson on the first working session, in the part about asking for a plan before anything changes.
Two more modes the shortcut won’t reach
Don’t ask and bypass permissions are the two remaining permission modes in Claude Code, and Shift+Tab will get you to neither. We cover them because sooner or later you will run into the names – in the documentation, on somebody’s screen – and it helps to know straight away that they aren’t the missing rungs of the same ladder.
Don’t ask
Don’t ask sounds like the loosest of the lot and gives Claude Code less room than any mode above: through goes only what your permission rules already approved, plus reading files, and everything else gets refused on the spot – no prompt, no waiting for you. Don’t ask was built for runs nobody is sitting next to, so rather than asking, it declines whatever isn’t on the list.
Those rules come from somewhere. They get written when you answer a permission prompt – in manual or in accept edits – with Yes, don’t ask again instead of a plain yes. A plain yes covers one situation and disappears with it; the other answer becomes a rule, permanently for commands and until the end of the session for file edits. The command /permissions shows you what you have on record.
There is one more thing about don’t ask that catches people out: you can’t switch into it mid-session. It is only ever chosen as the default, in the /config panel, and Claude Code reads its defaults at startup – so changing that setting does nothing to the conversation you are in. Don’t ask takes effect at the next launch.
Bypass permissions
Bypass permissions is an advanced mode in the literal sense: it isn’t in the /config settings at all, so the only ways in are a separate flag when you start Claude Code, or an entry in a settings file. In the desktop app there is a toggle on top of that, which has to be unlocked in the configuration first. What disappears then is not only the prompts but every check with them: no classifier judges anything, and the protected directories stop being protected.
This mode is also older than the rest, and the most useful way to read it is as a leftover from earlier versions of Claude Code. Before auto mode and its classifier existed, turning the checks off wholesale was the only way to work without an interruption every other minute, and that is how people used it. Anthropic now describes auto mode as the middle path between approving everything by hand and giving up the safeguards altogether – so the reason anyone reached for bypass permissions has, in most cases, stopped applying.
That is why we don’t recommend bypass permissions for ordinary work, and not out of caution – auto gives you the same thing in practice, work that runs without stopping on you, except that the risky parts get judged on the way. Leave bypass permissions to environments where nothing of value is at stake: a container, a test machine, a one-off run.
What no mode unlocks
A looser mode doesn’t mean anything goes, and this is the part worth knowing in advance so you don’t end up more nervous than the situation warrants. The documentation lists every protected location; these four are the ones you meet in practice:
- the directory holding your project’s change history (
.git) and the git configuration files, - the directory with Claude Code’s own settings,
- your shell’s startup files, the ones that run every time you open a terminal,
- editor and package manager settings.
In manual, accept edits and plan, a write to any of those stops at a prompt to you. In auto it goes to the classifier, which means it gets the same judgement as every other risky action – so it is neither blocked outright nor waved through in silence.
One detail here surprises people: the permission rules that record your approval in advance don’t cover these locations. The protection is checked before your rules are, so you can’t switch it off by granting yourself something broader. No press of the shortcut, and no approval clicked along the way, opens Claude Code a path to quietly rearranging your system.
Which mode for which kind of work
Picking a mode comes down to two thoroughly mundane things: when you look at what came out, and what a mistake in this particular folder would cost.
Early on, seeing every step is the point. Manual is the right place for that, and there is no rush to leave it – not because the rest is dangerous, but because watching every command is itself part of the learning. You see what Claude Code reaches for and in what order, and no amount of reading substitutes for that. After 14 August 2026 this takes a move on your part, since new sessions won’t return to manual by themselves.
Work you review as you go looks quite different. You are on a piece of text or a piece of code, you open the file after each change, and you will see what happened to it either way – accept edits saves you a great deal of clicking there, and costs you nothing, because the checking still happens a moment later, just somewhere else.
That leaves the case where you hand over a whole task and come back for the result. Manual stops helping here and starts getting in the way: the task sits still until somebody clicks, and clicking “yes” over and over is oversight in name only. Auto suits this work best, provided you genuinely check the result once it is there.
The question of how much the folder matters stands on its own. Notes and drafts are not the same as documents nobody can reconstruct – and that is a better reason to tighten the mode than a general sense that care is called for. You can change it mid-job anyway, with one shortcut.
Plan is deliberately absent from that list, because it answers a different question. You switch it on when the task is larger and you want to see what Claude Code intends to do first – whichever of the other modes you work in the rest of the time.
In short
The choice gets easy once you reduce it to a question about timing: at what point in the work do you look at what came out. During it – stay on manual or accept edits. Only at the end, once everything is done – auto fits better there and spares you the clicking you weren’t reading anyway.
None of this is a decision for good, or even for the week. The switch sits under two keys, and the boundaries no mode crosses are set independently of you. The worst a bad choice produces is one unnecessary prompt or one unnecessary click – rather less than the word “permissions” suggests.