Claude Code permission modes explained, and which settings a website team should pick

Claude Code has six permission modes, and each one decides how much Claude can do before it has to ask you. For most website teams the right setup is simple: Manual mode for sensitive work and your first weeks, plan mode before multi-file changes, Accept edits or auto mode on a branch of a local copy, dontAsk only for scripted checks, and bypass mode never on anything connected to your real site. On top of the mode, add permission rules that always ask before a push and always block reads of secret files.

The mode is only half the picture: rules in your settings files apply in every mode, and Team and Enterprise admins can switch some modes off. This guide explains each mode as Anthropic documents it in October 2026, how a session picks its starting mode, and the settings we'd give a web team. For the wider safety picture, including the sandbox, secrets and prompt injection, read is Claude Code safe for a live business website first.

The six modes at a glance

A permission mode sets "which actions Claude can take in a session without asking you first." The first two columns below are Anthropic's, from the permission modes page. The last column is our view for website work.

Manual and acceptEdits: you review, Claude works

In Manual mode, "Claude Code stops and asks you before most actions that edit files, run shell commands, or reach the network." Reads and a built-in set of read-only commands, such as ls, cat, grep, find and read-only git, run without asking. When a prompt appears, you can approve once or choose "don't ask again." For a shell command, that saves a rule to .claude/settings.local.json for the whole repository. Approvals for file edits last only until the session ends.

Accept edits lets Claude create and edit files in your working directory without asking. It also auto-approves common filesystem commands: mkdir, touch, rm, rmdir, mv, cp and sed, but only on paths inside the working directory. Other shell commands still prompt. Anthropic suggests it "when you want to review changes in your editor or via git diff after the fact rather than approving each edit inline."

That is the key condition on a website: Accept edits is fine on a branch whose diff someone will read before merging, and a poor fit if nobody will.

Plan mode: read first, change later

Plan mode lets Claude read files and explore, then present a plan. Edits stay blocked until you approve it. You can approve and continue in auto mode, approve and review each edit, or keep planning. Use it before redirects, template changes and sitewide edits. Our plan mode guide covers the details.

Auto mode: what the classifier allows and blocks

In auto mode, "a separate classifier model reviews actions before they run, blocking anything that escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read." Anthropic is direct about its limits: "Auto mode reduces permission prompts but does not guarantee safety."

As of October 2026, its default block list includes several items that matter on websites: production deploys and migrations, force push, changing DNS records or TLS certificates, merging a pull request no human has approved, approving Claude's own pull request, disabling CI checks, and printing a live credential into the transcript or a file.

The default allow list matters just as much. It includes "Reading .env and sending credentials to their matching API" and "Pushing to any branch of the repository you're working in, including the default branch." If your host deploys automatically from main, that default push can put changes live.

Three more behaviors are worth knowing:

• It steps back when it keeps blocking. If the classifier blocks an action 3 times in a row or 20 times in total, auto mode pauses and Claude Code goes back to prompting. Blocked actions are listed in /permissions under Recently denied.
• Chat boundaries are soft. If you say "don't push," the classifier blocks matching actions. But "boundaries are not stored as rules," and one "can be lost if context compaction removes the message that stated it."
• It reads your CLAUDE.md. An instruction such as "never force push" in your project's CLAUDE.md steers both Claude and the classifier.

dontAsk and bypass permissions: automation only

dontAsk "auto-denies every tool call that would otherwise prompt you." Claude still reads files, runs read-only commands and uses whatever your allow rules or a PreToolUse hook approve, and "the session never waits for input." It suits a scripted check that should only run your build and link checker. Anthropic's example is claude -p "run the test suite" --permission-mode dontAsk --allowedTools "Bash(npm test)" "Read". For pipeline setups, see Claude Code in GitHub Actions for website QA.

bypassPermissions "disables permission prompts and safety checks so tool calls execute immediately." Anthropic says to use it only "in isolated environments like containers, VMs, or dev containers without internet access," and warns that it "offers no protection against prompt injection or unintended actions." For a business website, the answer is simple: don't use it on a laptop, server or account that can reach your site, your hosting or your real credentials.

Which mode a session starts in

A new terminal session takes its starting mode from the first of these that applies: the --permission-mode flag, then permissions.defaultMode in a settings file, then the built-in default. With v2.1.283 or later, the built-in default for interactive terminal and VS Code sessions is auto mode. Organizations using Anthropic's HIPAA configuration start in Manual on v2.1.285 or later.

Some details trip teams up:

• Project files can't pick auto or bypass. Setting defaultMode to auto in .claude/settings.json or .claude/settings.local.json doesn't take effect, and bypassPermissions there starts the session in Manual. Other values, such as plan or default, do apply.
• VS Code reads its own setting. Conversations the VS Code extension starts use claudeCode.initialPermissionMode in your VS Code user settings, not the project's starting mode.
• The desktop app remembers per folder. A mode picked in the Code tab's selector is remembered for that folder, except Plan, which applies to the current session only.
• Cloud sessions are different. They offer Accept edits, Plan and Auto, pre-approve file edits in every mode, and ignore dontAsk and bypassPermissions from settings files.

Rules that apply in every mode

Permission rules sit on top of the mode. Allow rules let a tool run without asking, ask rules always prompt, and deny rules block. Anthropic's permissions page states the order: "deny, then ask, then allow. The first match in that order determines the outcome." A deny in any settings file beats an allow anywhere else, and "an allow rule can't carve an exception out of a deny rule."

The most important sentence on that page for non-developers: "Permission rules are enforced by Claude Code, not by the model." A line in CLAUDE.md or a prompt shapes what Claude tries to do. A rule decides what Claude Code lets it do.

Two more limits are built in. Writes to protected paths, such as .git, .claude and .mcp.json, are never auto-approved by an allow rule: they prompt in Manual and Accept edits, go to the classifier in auto, and are denied in dontAsk. And allow rules in a project's shared settings file only apply after you accept the workspace trust dialog for that folder, while its deny and ask rules apply regardless.

A starting settings file for a website team

This goes in the project's shared .claude/settings.json, checked into git so everyone gets it. It makes terminal sessions start in Manual, forces a prompt before pushes and pull requests even in auto mode, and keeps Claude's file tools away from secret files. Every key and rule format below is from Anthropic's docs, and a fuller version is in our Claude Code templates.

{
"permissions": {
"defaultMode": "default",
"ask": ["Bash(git push *)", "Bash(gh pr create *)"],
"deny": ["Read(./.env)", "Read(./.env.*)", "Read(./secrets/**)"]
}
}

Three notes. First, people can still switch to auto mode for a long job; the ask rules still hold there. Second, Anthropic's auto mode configuration page notes that an ask rule matches the command as written, so a push written as git -C <dir> push doesn't match. For a check on the full command text, use a PreToolUse hook; see hooks for website projects. Third, Read deny rules don't stop a shell command such as grep -r from reading a file it doesn't name, so keep real credentials out of the project folder altogether. Our guide to keeping API keys and passwords away from Claude Code covers how.

If your site deploys with its own command, add an ask rule for that command in the same Bash(command *) form, so a person confirms every deploy.

Admin switches for Team and Enterprise

On Team and Enterprise plans, auto mode is available by default. Admins can change that and more through managed settings, which user and project settings cannot override:

For a company website team, blocking bypass mode costs nothing and removes the riskiest option. Whether to disable auto mode depends on how much review your team does. Deployment of these settings is covered in managed settings and admin controls.

Conclusion

Pick the mode for the job, not for the person: Manual for sensitive or unfamiliar work, plan mode before anything sitewide, Accept edits or auto mode on a reviewed branch, dontAsk for scripts, and bypass only in a sealed-off container. Then make the important limits permanent with ask and deny rules, because a rule holds in every mode while a sentence in chat may not survive a long session. A person still reads the diff and approves every deploy. If you want these settings, hooks and a review process set up for your team, that is what our Claude Code consulting covers. More guides are in our Claude Code Guide.

Frequently asked questions