Permission Modes Comparison — Claude Cert Academy

Permission Modes Comparison

Claude Code has three permission modes that control when it asks for human approval before running tools. Choose based on your risk tolerance and environment.

Three Modes at a Glance

# Mode          | Prompts for approval? | Can block tools? | Use case                    | Risk
# --------------|----------------------|------------------|-----------------------------|------
# default       | Yes (per tool call)  | Yes              | Interactive dev, new tasks  | Low
# auto (--auto) | No                   | No               | Trusted scripts, CI basics  | Medium
# plan (--plan) | Plan shown, no exec  | N/A (no tools run)| Review before committing   | None

Default Mode

• Claude Code prompts you before each tool call: 'Run: rm -rf dist/ — Allow? [y/N]'
• You review every action. Slow for bulk operations but highest safety.
• Use when: exploring an unfamiliar codebase, running destructive operations, working with sensitive data.
• Override behavior: allow individual tools for the session by responding y, or deny with n.

Auto Mode

• Claude Code runs all allowed tools without asking. Prompts only when a tool matches a deny rule.
• Faster for tasks you've validated. Risk: Claude may take unexpected actions in unfamiliar code.
• Use when: running well-scoped, validated tasks in a repo you own. Example: automated changelog generation, test-suite triage.
• Enable: pass --auto flag or set permissions.mode: auto in settings.json.

Plan Mode

• Claude Code generates a detailed plan of what it would do (tools it would call, files it would edit) but does not execute anything.
• Zero execution risk. Use to preview impact before committing to an action.
• Enable: pass --plan flag or use /plan slash command during a session.
• Workflow: run --plan first, review the plan, then re-run without --plan to execute.

--dangerously-skip-permissions

• Bypasses all tool permission checks, deny rules, and approval prompts. Claude runs every tool call immediately without any gate.
• When safe: fully isolated ephemeral environments — Docker containers with no external access, CI sandboxes that are destroyed after the run, VMs with no production credentials.
• When dangerous: any machine that has access to production databases, secrets, live APIs, or cloud credentials. One bad tool call can be irreversible.
• Never use on: developer laptops, shared servers, or any environment where a destructive Bash command would cause real damage.

# Safe usage: inside a Docker container in CI
docker run --rm -e ANTHROPIC_API_KEY=$KEY my-sandbox-image \
  claude --dangerously-skip-permissions -p "run the test suite and fix failures"

# NEVER do this on a machine with prod access
claude --dangerously-skip-permissions -p "clean up old files" # DANGEROUS

settings.json Allow/Deny Patterns

Fine-grained tool control supplements the mode selection. Allow and deny rules use tool names and optional glob patterns on inputs.

{
  "permissions": {
    "mode": "default",
    "allow": [
      "Read",
      "Bash(npm test)",
      "Bash(npm run lint)"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Write(migrations/**)",
      "Bash(git push*)"
    ]
  }
}

• allow entries skip the approval prompt for that specific tool (or tool+pattern). Useful in default mode for trusted, repetitive operations.
• deny entries block matching tool calls entirely in all modes. The model sees a permission error.
• Pattern syntax: ToolName(glob) — the glob matches against the primary string argument (command for Bash, file_path for Read/Write).
• Deny takes precedence over allow if both match a tool call.

Decision Guide

• New or risky task on your codebase → use default mode. Review each action.
• Validated repeatable task, owned repo, no prod creds → use auto mode with deny rules for safety rails.
• Want to preview impact before committing → use --plan mode. Re-run without --plan to execute.
• Ephemeral CI sandbox, no prod access, fully isolated → --dangerously-skip-permissions is acceptable.
• Any doubt about environment isolation → default mode always.

Combine modes: use --plan in your PR review workflow to show reviewers what Claude would do, then use --auto in CI after the plan is approved. Default mode stays on during interactive development.

Continue to Claude Cert Academy