Home / Fundamentals and the agent loop

Permissions and plan mode

The permission mode decides which actions Claude Code carries out without asking, and since version 2.1.228, in an interactive terminal or VS Code session, the mode that greets a new session on the Pro, Max and Team plans is no longer default mode but auto mode, which acts broadly under the background watch of a second model.

The permission mode decides which actions Claude Code carries out without asking, and which ones stop in front of an on screen confirmation prompt. Checked against the official documentation on 2 September 2026, this choice now covers six modes, not the four older modes that some course notes still described.

Six modes, a different safety net each time

The default mode only reads, every file edit and every shell command wait for a reply. The acceptEdits mode edits files and runs common file system commands without asking, but stops in front of everything else. The plan mode stays read only while it produces a plan; when auto mode is available and the useAutoModeDuringPlan setting, active by default, allows it, a separate classifier approves certain shell commands during the planning itself, otherwise any command outside the read only core waits for manual approval. The auto mode acts broadly, edits files, runs commands, under the background watch of this same classifier, which by default runs on a model from the Sonnet family and blocks a few specific categories outright: downloading and then running code, exfiltrating sensitive data, deploying to production, deleting in bulk on cloud storage, or running git reset --hard and terraform destroy. The dontAsk mode does not go beyond the tools already approved in advance. The bypassPermissions mode removes the entire safety net, nothing stops any more.

The starting mode has changed

Since version 2.1.228 of Claude Code on macOS, Linux and WSL, and version 2.1.233 on native Windows, an interactive terminal or VS Code session opened on the Pro, Max and Team plans starts in auto mode rather than default mode, shown as Manual in the status bar. This change does not apply everywhere: an earlier version, the first session after an install or an update, the disableAutoMode variable set, claude -p, the Agent SDK, or a run on Bedrock, Vertex, Foundry or a gateway all still start in default mode. A task launched without checking the active mode can therefore run further than someone used to the older behaviour would expect, with the classifier's watch as the only safety net, under the conditions where auto mode actually applies. This classifier is not meant to watch without ever reacting: after a run of close together refusals, auto mode pauses itself and goes back to asking for confirmation, the figure that accompanies this lesson gives the exact figures for the two thresholds that trigger this pause.

claude --permission-mode plan
# launches the session directly in plan mode,
# read only until the plan is approved

The Shift+Tab shortcut cycles through the available modes from the keyboard, without leaving the current conversation: default, then acceptEdits, then plan, then bypassPermissions if it has been activated, then auto if it is available, before returning to default. The command line flag --dangerously-skip-permissions is exactly equivalent to bypassPermissions mode.

Plan mode, an airlock before writing

Plan mode remains the safest way to approach a task whose scope is not yet known: Claude reads, explores, proposes a sequence of actions, and nothing touches the disk before a plan is approved, except in a session where bypassPermissions mode is available, where edits are not held back waiting for that approval. On a task that touches several files at once, this airlock costs a few seconds of reading and avoids discovering afterwards that a starting assumption was wrong. If an approved plan still heads in the wrong direction while it runs, the Esc key interrupts the current turn without losing the work already done.