Claude Code permission modes, compared.
Permission modes decide how Claude Code handles tool approvals. They are not interchangeable with sandboxing: a mode changes approval behavior, while a sandbox limits what tools can reach.
| Mode | Behavior | Use it when | Example |
|---|---|---|---|
| default / Manual | Prompts for actions that need approval. | You want human review around writes, commands and external actions. | claude |
| acceptEdits | Auto-accepts file edits and common filesystem changes in allowed directories. | Most risk is outside ordinary source edits. | claude --permission-mode acceptEdits |
| plan | Prioritizes read/analysis and planning before source-file modification. | You are exploring an unfamiliar repository or planning a refactor. | claude --permission-mode plan |
| auto | Uses background safety checks to make many permission decisions. | You need longer autonomous tasks with more protection than raw bypass. | claude --permission-mode auto |
| dontAsk | Does not prompt; non-preapproved tools are denied. | You want predictable automation based on explicit allow rules. | claude --permission-mode dontAsk |
| bypassPermissions | Skips permission prompts except actions no mode auto-approves. | The environment is isolated and disposable, and you control inputs. | claude --permission-mode bypassPermissions |
Permission rules still matter
Claude Code also supports explicit allow, ask and deny rules. Deny rules can block a tool or command pattern; ask rules force confirmation; allow rules can remove repeated approvals for narrow, known-safe operations. This is often a better long-term workflow than globally bypassing permission prompts.
When Auto Mode makes more sense
Auto Mode exists for the exact middle ground many developers want: fewer interruptions without handing every decision to the agent. It is a better starting point for long-running coding work where an isolated environment is not available.
When bypassPermissions is appropriate
Use bypass mode only when the surrounding environment is designed for it, such as an isolated container or disposable VM with controlled credentials, limited network access and a clean rollback path.