Home / Fundamentals and the agent loop

Permissions and plan mode

The permission mode decides which actions Claude Code carries out without asking: since September 2026, an interactive terminal or VS Code session with no configured mode starts in auto mode, on every plan, rather than default mode, and auto mode acts broadly under the background watch of a second model.

The permission mode decides which actions Claude Code carries out without asking, and which ones stop in front of a confirmation prompt. Since September 2026, an interactive terminal or VS Code session starts in auto mode when no mode is configured, on every plan. The starting mode is therefore no longer the one that asks before every action.

Six modes, a different safety net each time

The default mode, shown as manual mode on in the status bar, only reads: every edit and every shell command wait for a reply. The acceptEdits mode edits files and runs common file system commands, but stops in front of the rest. The plan mode stays read only while it produces a plan. The auto mode acts broadly under the background watch of a classifier, a second model that blocks a few categories outright: downloading and then running code, exfiltrating sensitive data, deploying to production, deleting in bulk on cloud storage, running git reset --hard or terraform destroy. The dontAsk mode does not go beyond the tools approved in advance. The bypassPermissions mode removes the entire safety net.

When a session does not start in auto

The disableAutoMode setting, an unsupported model, an organization under a HIPAA configuration or a server-side shutdown put the session back in manual mode. claude -p and the Agent SDK also start in default since October 2026: a call that needs approval is refused there until an allow rule or a hook grants it. A task launched without checking the active mode can therefore run further than planned, with the classifier as the only safety net. This classifier reacts: after a run of close together refusals, auto mode pauses and asks for confirmation again, and the figure gives the two thresholds.

claude --permission-mode plan
# launches the session directly in plan mode,
# read only until the plan is approved

Shift+Tab cycles through the available modes without leaving the conversation: default, acceptEdits, plan, bypassPermissions if it is enabled, auto if it is available, then back to default. The --dangerously-skip-permissions flag is equivalent to bypassPermissions mode.

Tuning what auto mode lets through

Before a read outside the working directories, auto mode raises a prompt: the answer "Yes, but ask again next time" allows that read without opening the door to the next ones. The /auto-mode-setup command reads the project and recent sessions to teach auto mode about your environment, which cuts needless refusals without switching to bypass. On the rules side, mcp__a now covers only a server named a, not a__b or a_: write mcp__server__* for a whole server. A Bash rule with :* in the middle of the pattern, skipped until now in settings files, now applies there: reread yours.

Plan mode, a read only pass before writing

Claude reads, explores, proposes a sequence of actions, and nothing touches the disk before the plan is approved, except in an interactive terminal where bypassPermissions mode is available: edits there no longer wait for approval. Outside that case, plan mode remains truly read only, even against a PreToolUse hook that would allow a write. If an approved plan heads in the wrong direction, the Esc key interrupts the current turn without losing the work already done.