What are permission modes in coding agents?

Press Shift+Tab to cycle through them, start in one with claude --permission-mode, or set a default with permissions.defaultMode in a settings file.

• default (also called Manual): asks before most edits, shell commands and network actions.
• acceptEdits: approves file edits and common file commands such as mkdir, mv and cp inside the working directory.
• plan: Claude researches and proposes a plan but can’t change source files until you approve it.
• auto: a classifier model reviews each action in your place, so most run without a prompt; after repeated blocks it goes back to asking. Recent versions start interactive sessions in auto where it’s available.
• dontAsk: denies anything that would otherwise prompt; meant for CI and locked-down scripts.
• bypassPermissions (the --dangerously-skip-permissions flag): skips prompts and safety checks; meant only for isolated containers or VMs.

Codex splits the question in two: when to ask you (the approval policy) and what commands can technically reach (the sandbox, enforced by the operating system with Seatbelt on macOS and bwrap with seccomp on Linux).

• Sandbox modes: read-only, workspace-write (edits inside the workspace) and danger-full-access. Network access is off by default.
• Approval policies: on-request asks when the agent needs to step outside the sandbox; never doesn’t ask at all.
• The Auto preset (workspace-write with on-request) is what Codex uses in a version-controlled folder; /permissions switches mode during a session.
• approvals_reviewer = "auto_review" sends eligible approval requests to a reviewer agent instead of you.
• --yolo, short for --dangerously-bypass-approvals-and-sandbox, turns off both; OpenAI doesn’t recommend it.

An agent left alone overnight or in CI can’t wait for a click: a prompt nobody answers stalls it for hours, while skipping every check lets one bad command do real damage. The usual answer is to remove the prompts and keep the guardrails somewhere else.

• Run in a sandbox, container or VM that only sees the project, not your SSH keys or home folder.
• Pre-approve safe commands with allow rules and deny the destructive ones, such as git push, rm -rf and deploys.
• Let the agent commit to a branch but not push, and review it in the morning.
• In CI, use the non-interactive options: dontAsk in Claude Code, or codex exec with an explicit sandbox.

Use plan mode to agree on an approach before a large change, default or acceptEdits while you’re at the keyboard, and auto or a sandboxed preset for long runs you only check on now and then. Keep the bypass options for throwaway environments. Our guide to running Claude Code overnight walks through a full setup.