Permission Modes

Describe the three permission modes (default, auto, plan)

Switch between modes using Shift+Tab

Know when to use each mode

Configure a default mode for your projects

Understand how modes affect Claude's behavior

Claude Code asks for permission before taking actions that could change your system. Write a file? Permission needed. Run a command? Permission needed. This keeps you in control but can slow you down when you trust what Claude is doing.

Permission modes let you adjust this balance. You can tighten control when working on sensitive code or loosen it when you want Claude to move quickly.

This lesson covers the three permission modes, when to use each, and how to switch between them.

In default mode, Claude asks permission for actions that could modify your system.

What requires permission:

Writing or editing files

Running shell commands

Using MCP tools that have side effects

What does not require permission:

Reading files

Searching code

Answering questions

This is the standard mode most people use. You stay informed about what Claude does while allowing read operations to happen quickly.

Auto mode uses a separate classifier model to review actions before they run. The classifier blocks risky actions but allows routine ones to proceed without asking.

Then select auto mode, or toggle with Shift+Tab until you see "auto mode on."

What auto mode blocks:

Scope escalation (actions that grant more access)

Unknown infrastructure changes

Actions that look hostile or dangerous

What auto mode allows:

Normal file edits

Standard build and test commands

Common development operations

Auto mode is useful when you trust the general direction of a task but do not want to click through every approval. Claude moves faster while still having guardrails.

Command line:

Start a session directly in auto mode.

Plan mode restricts Claude to read-only operations. Claude can explore, analyze, and plan but cannot modify anything.

Or toggle with Shift+Tab until you see "plan mode on."

What Claude can do in Plan Mode:

Read files

Search code

Analyze architecture

Create detailed plans

Ask clarifying questions

What Claude cannot do:

Write or edit files

Run commands with side effects

Make any changes to your system

Plan mode is for safe exploration. Use it when you want to understand code or plan changes without risk of accidental modification.

Shift+Tab cycles through modes:

Default mode

Auto mode (shows "accept edits on")

Plan mode (shows "plan mode on")

Back to default

The current mode is shown at the bottom of your screen.

Direct commands:

Enter plan mode directly.

Command line flags:

Start a session in a specific mode.

Default mode:

Normal development work

When you want to review changes

When working on critical code

When learning Claude Code

Auto mode:

Trusted tasks where you do not need to review every step

Bulk operations (fix lint errors, update imports)

When you are watching but do not want interruptions

Running in CI/CD pipelines

Plan mode:

Exploring unfamiliar codebases

Planning complex refactors

Code review without changing anything

When you want Claude's analysis but not its actions

You can set a default mode for a project in .claude/settings.json:

This makes all sessions in this project start in plan mode. Useful for repositories where you always want to plan before executing.

Options:

"default" - Normal permission asking

"auto" - Auto mode classifier

"plan" - Read-only plan mode

Plan-then-execute workflow:

Start in plan mode

Explore the codebase

Ask Claude to create a detailed plan

Review and refine the plan

Switch to default mode

Tell Claude to execute the plan

This separates analysis from action.

Auto mode for batch work:

Switch to auto mode

Ask Claude to fix all lint errors

Watch as Claude works through files

Review the results afterward

This gets tedious work done quickly.

Default mode for learning:

Stay in default mode

See each action before it happens

Learn what Claude does and why

Build trust before using auto mode

Starting with default mode teaches you how Claude works.

Auto mode is not unlimited:

The classifier catches dangerous actions. But it is not perfect. If you are working with production systems, sensitive data, or security-critical code, default mode or plan mode is safer.

Plan mode for auditing:

When you want to audit code or understand a system without any risk of changing it, plan mode guarantees safety.

Reverting:

If auto mode makes unwanted changes, use /rewind to restore. All changes are checkpointed regardless of mode.

Default mode asks permission for modifications but allows reads

Auto mode uses a classifier to allow routine actions and block risky ones

Plan mode restricts Claude to read-only operations

Switch modes with Shift+Tab or direct commands

Use default for normal work, auto for trusted tasks, plan for safe exploration

Configure a default mode in settings.json if you always want a specific mode

Practice with permission modes:

Start Claude Code in a project.

Notice the current mode at the bottom of the screen.

Press Shift+Tab to switch to auto mode.

Ask Claude to make a small change and notice it happens without asking.

Press Shift+Tab to switch to plan mode.

Ask Claude to analyze some code.

Try asking Claude to make a change. Notice it cannot.

Press Shift+Tab to return to default mode.

Make a change and see the permission prompt return.

This exercise builds familiarity with each mode.

https://code.claude.com/docs/en/permission-modes - Detailed mode documentation

https://code.claude.com/docs/en/best-practices - Mode recommendations by workflow

https://code.claude.com/docs/en/permissions - Permission configuration