This lesson is being recorded
Every video of this course is being uploaded to my YouTube channel. Subscribe so you do not miss it.
Bruno Ashford @brunoashfordSubscribeModule 11 · Lesson 11.1 · 11 min
Permission Modes
Understand Claude Code's permission modes and rules, and configure how much the agent can do without asking you.
Use ← → to move. The marker highlights text and the pencil draws on the slide; navigation locks while you annotate. Undo removes the last mark, Esc exits.
1Know the modes
Manual mode (config value default) asks before edits and commands. acceptEdits lets Claude edit files without asking. plan mode lets it read and plan but not change anything. auto mode uses a second model, a classifier, to review actions in the background instead of you. dontAsk denies anything not pre-approved, ideal for scheduled runs. bypassPermissions skips checks entirely and belongs only in isolated containers.
2Switch modes during a session
Press Shift+Tab to cycle through the modes; the status bar at the bottom shows which one is active. In recent versions many sessions start in auto mode, so check the status bar rather than assuming. Use plan mode whenever you want Claude to think before touching anything, such as a new process or a sensitive client file.
claude --permission-mode plan3Pre-approve the safe and ban the dangerous
Permission rules live in .claude/settings.json under allow, ask and deny. Deny always wins, then ask, then allow, and deny rules apply in every mode, even when checks are otherwise skipped. Type /permissions to see and edit your rules and which file each one comes from.
{
"permissions": {
"allow": [
"Read",
"Edit(./reports/**)",
"Bash(git status *)"
],
"ask": [
"Bash(git commit *)"
],
"deny": [
"Read(./.env)",
"Read(./secrets/**)",
"Bash(git push *)",
"Bash(rm -rf *)"
]
}
}4Set a default for your project
You can make a mode the starting point for a project by setting defaultMode inside permissions, for example plan for a folder with sensitive client files. Personal preferences go in ~/.claude/settings.json; team rules go in the project's .claude/settings.json so everyone gets them.
Review my .claude/settings.json. Propose permission rules for this business folder: allow reading everything except secrets, allow edits only inside reports and drafts, ask before any git commit, and deny reading .env files, deleting folders and pushing to any remote. Explain each rule in one plain-English line before changing anything.5Remember what rules can and cannot do
Permission rules are enforced by Claude Code itself, not by the model, which is exactly why they are reliable. Instructions in CLAUDE.md shape what Claude tries to do, but they do not change what it is allowed to do. For anything that must never happen, use a deny rule or a hook, not a sentence in a prompt.
Owners tend to fall into one of two traps. Some approve every single action for weeks, get tired, and start clicking yes without reading, which is worse than no checks at all. Others switch everything off on day two because the prompts slowed them down. Both are the same mistake: treating permissions as all or nothing.
Claude Code gives you a dial, not a switch. Permission modes set the baseline for a session, and permission rules let you pre-approve safe actions and permanently ban dangerous ones. The goal is simple: no prompts for the boring, safe work, and a hard stop for anything that can hurt the business.
Key points
- Permissions are a dial, not a switch.
- Shift+Tab cycles modes; the status bar tells you which is active.
- Deny beats ask beats allow, in every mode.
- Rules are enforced by Claude Code; prompts are only guidance.
Avoid
- Approving everything without reading because the prompts feel repetitive.
- Using bypassPermissions on your own laptop.
- Writing never delete files in CLAUDE.md instead of a deny rule.
- Putting team rules in personal settings, so nobody else gets them.
A three-partner accounting firm wanted staff to use Claude Code on client folders but worried about tax records being altered. They set plan mode as the default for the clients folder, allowed edits only in a drafts folder, and denied reading any file with credentials in its name. Staff now draft letters and reconciliations freely in drafts, and nothing in the original client records can be changed without a person moving it there. Approval prompts dropped by roughly 70 percent while the partners slept better.