Permission modes
One dial decides how often you are asked. Shift+Tab moves it, and picking the right position for the job is most of what makes long runs bearable.
| Mode | What it does | When |
|---|---|---|
| Manual | Asks before file edits and shell commands | Unfamiliar code, or anything you would not want done twice |
| Accept edits | Edits files and runs common filesystem commands without asking, still asks for other commands | A change you already agreed to in a plan |
| Plan | Reads and explores, refuses to touch your source | Working out what to do, from lesson 5 |
| Auto | A classifier reviews actions in the background and blocks the risky ones instead of asking you | The starting mode for interactive sessions on paid plans |
Auto is the one worth understanding rather than accepting. It does not mean everything is allowed. It means a check runs on each action and the risky ones are stopped without a prompt appearing, which is a different trade: fewer interruptions, and a decision made by a classifier rather than by you.
There is also bypassPermissions, which asks nothing and checks nothing. It does not appear in the cycle unless you start the session with a flag that enables it, and that friction is deliberate.
Choosing one
The useful question is not how much you trust the model. It is what the worst action in reach can do, and whether it can be undone. Editing a file is undoable, lesson 6 showed how. A shell command that pushes, deploys, deletes or emails is not.
- Cycle Shift+Tab through the modes and watch the status bar change.
- Start a session with
claude --permission-mode planand see what it refuses.
Every expert started right here.