Claude Code is not the IntelliJ or Cursor plugin you're used to. It's a command-line tool — you run it in your terminal, in or alongside your project.
There are 6 modes total. Think of them as a dial from "ask me everything" → "ask me nothing."
1. default (Manual)
What runs without asking: reads only. Everything else — file edits, shell commands, network requests — prompts for confirmation.
Who uses it: Anyone working in an unfamiliar codebase, shared machines, or security-sensitive work. The conservative baseline.
2. acceptEdits
What runs without asking: reads, file edits, and common filesystem commands like mkdir, touch, mv, cp, rm — but only within your working directory. Everything riskier (arbitrary shell, network calls, writes outside working directory) still prompts.
Who uses it: Developers iterating on their own code who'd rather review diffs in git diff after the fact than approve every individual edit inline.
3. plan
What it does: Claude researches the codebase and proposes a plan but does not edit any source file until you explicitly approve. It can run read-only shell commands to explore.
Who uses it: Teams or devs jumping into a large/unfamiliar project before committing to changes. Also useful as a pre-flight check before handing off to a more autonomous mode.
4. auto ⭐ (Most commonly used in production going forward)
What runs without asking: essentially everything — but a separate classifier model reviews each action before it runs. The classifier blocks things like curl | bash, production deploys, mass deletions, force pushes, IAM/permission changes, and sending secrets to external endpoints. Routine local file ops and dependency installs pass silently.
There's an important upcoming change: starting August 14, 2026, auto mode becomes the default permission mode for new sessions on Pro, Max, and Team plans.
Who uses it: Anyone doing long agentic tasks, refactoring sessions, or multi-step workflows where constant approval prompts would break flow — but who still wants a safety net. This is the sweet spot for most professional use.
5. dontAsk
What runs without asking: only tools that match your explicit permissions.allow rules and built-in read-only commands. Everything else is auto-denied — Claude never waits for input.
Who uses it: CI/CD pipelines and automation scripts. You pre-define exactly what Claude is allowed to do, and the session runs headlessly without any human interaction.
6. bypassPermissions ☠️
What runs without asking: everything, including writes to normally protected paths. Permission prompts and safety checks are fully disabled.
The only exceptions are: explicit ask rules you've configured, and a circuit-breaker that still prompts for catastrophic removals like rm -rf / or rm -rf ~.
Who uses it: Only in fully isolated environments — Docker containers, VMs, dev containers without internet access. Never on a machine with production credentials or real data.
Summary Table
| Mode | Auto-approves | Gates | Typical user |
|---|---|---|---|
default | Reads only | Everything else | Unfamiliar codebases, cautious work |
acceptEdits | Reads + file edits in workdir | Shell, network, outside workdir | Solo dev, iterating fast |
plan | Read + propose only | All file edits until you approve | Pre-flight exploration |
auto | Everything (classifier reviewed) | Classifier-blocked actions | Long agentic tasks, production teams |
dontAsk | Only pre-approved tools | Everything not in allow-list | CI/CD, headless automation |
bypassPermissions | Everything | Only explicit ask rules + rm-rf circuit breaker | Isolated containers/VMs only |
Which is most common in production?
auto is the direction the ecosystem is moving. It's becoming the default for new sessions on Pro, Max, and Team plans from August 14, 2026. For CI/CD pipelines specifically, dontAsk with a carefully crafted allow-list in .claude/settings.json is the right choice — it never stalls waiting for human input. bypassPermissions is essentially never appropriate outside a sandboxed container.
Now: what is the "classifier model" in auto mode?
When you're in auto mode and Claude Code wants to run an action — say, git push or rm -rf build/ — instead of popping up a prompt asking you to approve it, it first sends that pending action to a second AI model running server-side at Anthropic. That model's sole job is to evaluate: "Is this action safe given what the user asked for?"
Specifically, it reads a portion of your conversation transcript plus the pending action, and returns allow or block.
From the official docs: the classifier runs on Claude Sonnet 5 by default (not your session model), unless your session model is Sonnet 4.6, in which case it falls back to the session model.
Where does it "sit"?
It runs on Anthropic's servers, not locally. Your Claude Code session is already making API calls to Anthropic to generate responses — the classifier is an additional server-side call that happens before a risky action executes. You don't install it, configure it, or see it directly. It's invisible infrastructure.
The architecture looks roughly like this:
Now: what is the "classifier model" in auto mode?
When you're in auto mode and Claude Code wants to run an action — say, git push or rm -rf build/ — instead of popping up a prompt asking you to approve it, it first sends that pending action to a second AI model running server-side at Anthropic. That model's sole job is to evaluate: "Is this action safe given what the user asked for?"
Specifically, it reads a portion of your conversation transcript plus the pending action, and returns allow or block.
From the official docs: the classifier runs on Claude Sonnet 5 by default (not your session model), unless your session model is Sonnet 4.6, in which case it falls back to the session model.
Where does it "sit"?
It runs on Anthropic's servers, not locally. Your Claude Code session is already making API calls to Anthropic to generate responses — the classifier is an additional server-side call that happens before a risky action executes. You don't install it, configure it, or see it directly. It's invisible infrastructure.
The architecture looks roughly like this:
The bypass mode:
The transcript
The following pairing session happened on a codebase cleanup that had been running without incident for three days.
No comments:
Post a Comment