Available modes

Each mode makes a different tradeoff between convenience and oversight. The table below shows what Claude can do without a permission prompt in each mode. Manual mode appears under its config value, default.

Mode	What runs without asking	Best for
default	Reads only	Reviewing every action yourself, sensitive work
acceptEdits	Reads, file edits, and common filesystem commands (mkdir, touch, mv, cp, etc.)	Iterating on code you're reviewing
plan	Reads, plus classifier-approved commands when auto mode is available	Exploring a codebase before changing it
auto	Everything, with background safety checks	Long tasks, reducing prompt fatigue
dontAsk	Only pre-approved tools	Locked-down CI and scripts
bypassPermissions	Everything	Isolated containers and VMs only

The mode that reviews every action is named Manual in the CLI, in claude --help, in the VS Code and JetBrains extensions, and in the desktop app. Its config value is default, which is what hooks and SDK integrations use. The CLI accepts manual as an alias wherever you type the value, for example claude --permission-mode manual or "defaultMode": "manual". The Manual label and the manual alias require Claude Code v2.1.200 or later. The desktop app's label doesn't depend on your CLI version.

Writes to protected paths are never auto-approved except in bypassPermissions mode and in plan-mode sessions where bypass permissions are available, meaning sessions started in a way that puts bypassPermissions in the mode cycle.

Modes set the baseline. Layer permission rules on top to pre-approve or block specific tools. Deny rules block in every mode, including bypassPermissions. Deny and ask rules don't apply to EndConversation as long as Claude still has at least one other tool it can call. Allow rules have no effect in bypassPermissions.

Actions no mode auto-approves

Claude Code doesn't auto-approve the following in any mode, including bypassPermissions. Each bullet links to the section that says what happens instead in each mode:

• Tools matched by an explicit ask rule
• Connector tools your organization set to ask, in sessions where that setting reaches Claude Code
• Tools that require user interaction: the built-in AskUserQuestion tool and MCP tools marked requiresUserInteraction
• rm and rmdir removals targeting a critical path, which no allow rule or PreToolUse hook "allow" approves
• The cross-session messaging safeguards
• Reads outside the working directories while permissions.blockReadsOutsideWorkingDirectories is on: recognized file-reading Bash commands and any unsandboxed retry that needs approval to run outside the sandbox prompt even in auto mode and bypassPermissions mode. Requires Claude Code v2.1.257 or later