Claude Code permissions: modes, rules and the skip flag

The cards above use Termdeck's names. Claude Code itself has six modes, and these are the values you type after --permission-mode or put in defaultMode:

Manual is the mode that reviews every action. Its config value is default, and Claude Code accepts manual as an alias, so claude --permission-mode manual and "defaultMode": "manual" both work. dontAsk is meant for CI and scripts: the session never waits for input.

In Termdeck's picker, Supervised is default, Accept edits is acceptEdits, Plan only is plan, Auto is auto and Full access is bypassPermissions. dontAsk is not offered, because a browser chat always has someone to ask.

At startup Claude Code takes the first of: the command line flag, permissions.defaultMode in a settings file, the built-in default.

During a session, press Shift+Tab. From auto, the first press goes to Manual, and the cycle then runs Manual, accept edits, plan. Bypass and auto slot in after plan when they are enabled. dontAsk is never in the cycle.

At launch, pass the flag. It works with -p too:

claude --permission-mode acceptEdits
claude -p "run the tests and fix failures" --permission-mode auto

As a default, set defaultMode in a settings file:

{
  "permissions": {
    "defaultMode": "acceptEdits"
  }
}

One catch: auto and bypassPermissions are ignored when they come from a project's .claude/settings.json or .claude/settings.local.json, so a cloned repository cannot put you in bypass mode. Put those two in ~/.claude/settings.json if you want them as your default. If a session starts in Manual when you expected auto, that is usually why.

claude --dangerously-skip-permissions starts the session in bypassPermissions mode. It is the same as --permission-mode bypassPermissions, and it is what people mean by Claude Code yolo mode. Tool calls run immediately, including writes to protected paths such as .git and .claude, and allow rules stop mattering because everything is allowed.

A few things still stop it. Deny rules block in every mode, including this one. Explicit ask rules still prompt. An rm or rmdir that targets your filesystem root, a top-level directory, your home directory or your working directory still asks, with a two-minute countdown in the terminal that denies it if nobody answers.

The first interactive run shows a warning you have to accept (it records skipDangerousModePermissionPrompt in ~/.claude/settings.json). --allow-dangerously-skip-permissions is the softer variant: it adds bypass to the Shift+Tab cycle without starting in it. You cannot switch into bypass from a session that was started without one of these.

"cannot be used with root/sudo privileges"

On Linux and macOS, Claude Code refuses bypass mode when it runs as root or under sudo:

--dangerously-skip-permissions cannot be used with root/sudo privileges for security reasons

The fix is to run Claude Code as a normal user, which is what Anthropic's dev container configuration does. Anthropic's docs say the check is skipped inside a recognised sandbox; do not try to defeat it on a machine you care about.

When it is reasonable

Inside a container, a VM or a dev container with no access to credentials you care about, on a checkout you could delete. Anthropic's own help text adds "with no internet access". It is the wrong choice on your laptop's real home directory, on a machine with production credentials, or in any repository you have not read, because it offers no protection against a prompt injection in a file Claude reads. Administrators can switch it off with "disableBypassPermissionsMode": "disable" under permissions, usually in managed settings.

If what you want is a hands-off session, auto mode is the option Anthropic built for it. A separate classifier model reviews each action that is not a read or an in-project edit, before it runs. It is the built-in starting mode for interactive sessions from version 2.1.283.

By default it blocks things like curl | bash, production deploys, force pushes, git reset --hard and launching another agent with --dangerously-skip-permissions, and allows local file work and pushes to the repository you are in. claude auto-mode defaults prints the full lists.

If it blocks 3 actions in a row or 20 in a session, auto mode pauses and Claude Code goes back to asking. Auto mode needs a supported model (Opus 4.6, Sonnet 4.6 or later on the Anthropic API) and can be switched off with "disableAutoMode": "disable". Anthropic's own warning applies: it reduces prompts, it does not guarantee safety.

Rules sit on top of the mode. Each is Tool or Tool(specifier), and they live under permissions in a settings file:

{
  "permissions": {
    "allow": [
      "Bash(npm run *)",
      "Bash(git commit *)",
      "WebFetch(domain:github.com)"
    ],
    "ask": [
      "Bash(git push *)"
    ],
    "deny": [
      "Read(./.env)",
      "Read(./secrets/**)",
      "Bash(curl *)"
    ]
  }
}

Claude Code checks deny, then ask, then allow, and the first match wins. A narrow allow cannot carve an exception out of a broad deny: with Bash(aws *) denied, Bash(aws s3 ls) in allow does nothing.

• Bash. * matches any text. Bash(npm run build) is exact; Bash(npm run *) covers every npm script. The space matters: Bash(ls *) does not match lsof, Bash(ls*) does. The older Bash(npm run test:*) form still works and means the same as a trailing *. Put the * after the subcommand: Bash(git *) allows every git command.
• Compound commands. A rule must match each part of a && b or a | b on its own, so an allow for npm test does not approve npm test && rm -rf build.
• Read and Edit. Paths use gitignore patterns. //path is absolute, ~/path is from your home directory, /path is relative to the settings file's project, and ./path to the current directory. Use Edit(...) rules for writes; Write(path) rules never match.
• WebFetch and MCP. WebFetch(domain:example.com) for one host, mcp__github__* for one MCP server.

A Bash deny is not a security boundary: Bash(curl *) stops curl but not /usr/bin/curl or sh -c 'curl ...'. For an enforced limit, turn on the sandbox with /sandbox (macOS, Linux and WSL2), which restricts what shell commands can reach at the operating system level.

The same rules work as flags for one session. Each takes a comma or space separated list:

claude --allowedTools "Bash(git *)" "Edit"
claude --disallowedTools "Bash(rm *)" "WebFetch"
claude -p "run the test suite" --permission-mode dontAsk --allowedTools "Bash(npm test)" "Read"

The last line is the pattern for CI: dontAsk denies anything you did not list, so the run never hangs on a prompt. Without a mode, claude -p starts in Manual since 2.1.302, and any call that needs approval is denied unless a rule allows it. --disallowedTools adds restrictions even on top of managed settings; --allowedTools cannot override a deny from any file.

When the same key is set in several places, the highest level wins:

1. Managed settings from your organisation (managed-settings.json, MDM or server-managed). Nothing below overrides them.
2. The command line: JSON passed with --settings for that one session.
3. Local project settings, .claude/settings.local.json. Yours, not committed.
4. Shared project settings, .claude/settings.json. Checked in for the team.
5. User settings, ~/.claude/settings.json. Every project on your machine.

Permission rules are the exception to "highest wins": a deny at any level blocks, so a user-level deny beats a project-level allow and the other way round. Allow rules in a project's .claude/settings.json only apply after you accept the workspace trust dialog for that folder.

Type /permissions in a session to see every rule and the file it came from, and to add or remove one. When you pick "Yes, and don't ask again" on a Bash or WebFetch prompt, Claude Code saves the rule to .claude/settings.local.json at the repository root. File edit approvals last only until the session ends.

Plan mode is the one mode that is about workflow rather than trust: Claude reads, explores and writes a plan, and edits stay blocked until you approve it. Enter it with Shift+Tab, a /plan prefix or --permission-mode plan. Approving switches the session to auto or Manual depending on the option you pick. The full walkthrough, including editing the plan and opusplan, is in Claude Code plan mode: how to use it and when.

A prompt in a terminal only gets answered when you are looking at that terminal. Termdeck runs Claude Code on your own machine and puts the prompt in a browser tab or on your phone as a card: the exact command, a risk level, and Deny, Allow once, a grant for this chat, or a rule saved into Claude Code's own settings. Plan approvals arrive the same way. Unanswered permission cards are denied after five minutes so a run does not sit blocked; plans and questions wait.

The mode is picked per chat in the composer, so one chat can run in Auto while another stays in Supervised. To make sure nothing on a given machine ever runs in bypass mode, set TERMDECK_FULL_ACCESS=off in that machine's agent config. The setup is in approve Claude Code permissions remotely, and every button is described in the permissions docs. If a prompt never shows up in the browser, see permission prompt never appears.

Other engines differ: see Codex CLI approval modes and Grok CLI permission modes.