Anyone who has used an agent for real work has been through this arc. Day one, every permission prompt is fascinating — oh, that’s what it wants to do. Day three, you’re clicking approve without reading. Day five, you’re wondering whether there’s a way to turn this off, and you find one, and it’s called --dangerously-skip-permissions, and the name is doing a lot of work.
That gap — between an interruption you’ve stopped reading and no safety at all — is the problem auto mode exists to solve.
What auto mode does
In auto mode, Claude’s permission prompts are handled by a safety classifier instead of by you. Routine actions run without interrupting you. Risky ones get blocked.
The key word is blocked, not approved. This is the distinction people miss:
- Skipping permissions removes the checks. Everything runs.
- Auto mode removes the interruption. The evaluation still happens; it just happens in the background, and dangerous things are stopped rather than waved through.
You’re not trading safety for speed. You’re trading your attention for a classifier’s, which — after the tenth identical prompt — is a trade heavily in your favour.
The permission modes, in order of leash length
It helps to see the whole range rather than just this one setting:
| Mode | What happens | Good for |
|---|---|---|
| Plan mode | Claude analyses and proposes; changes nothing | Understanding before acting |
| Ask permissions / Manual | Claude asks before anything consequential | Learning, and high-stakes work |
| Accept edits | File edits go through; other actions still ask | Focused editing sessions |
| Auto mode | A classifier allows safe actions and blocks risky ones | Most real work, most of the time |
| Skip permissions | No checks | Sandboxes and throwaway environments |
Two notes worth knowing. The mode formerly called “default” is now named “Manual” across the CLI, --help, VS Code, and JetBrains — same behaviour, clearer name. And accept edits got safer: it now prompts before writing files that can execute code, rather than treating every file write as equivalent.
On Desktop these live behind a mode selector, and the docs steer new users toward the “Ask permissions” mode. That’s the right starting point, and this guide is about knowing when to leave it.
What auto mode actually blocks
This is the part that determines whether you should trust it, so it’s worth being concrete. Auto mode has been hardened repeatedly, and the blocks are specific rather than vague:
- Destructive git commands when you didn’t ask to discard local work. The classic disaster — an agent “cleaning up” and taking your uncommitted changes with it — is a named, blocked category.
rm -rfon unresolved variables. If a delete path contains something that didn’t expand properly, it asks rather than guesses. This is the exact shape of the bug that has wiped real people’s home directories for thirty years.- Transcript tampering — modifying the record of what happened in a session.
- Hard deny rules you write yourself, which block an action unconditionally, regardless of any allow rule that might otherwise permit it. That’s an important property: your prohibitions aren’t overridable by a permissive rule elsewhere.
Organisations can also write allow and deny rules that match specific tool parameters, not just tool names — so “this agent may not use that model” or “never touch that path” is expressible.
When to switch it on
The honest signal is behavioural, not technical: switch when the prompts have stopped teaching you anything.
In your first days, each prompt is genuinely informative — you’re building a mental model of what an agent does with a task. Interrupting is the point. Once you can predict what the next prompt will say before you read it, the prompt has become noise, and noise is worse than useless because it trains you to click approve reflexively. That reflex is the actual danger, and it’s the one auto mode removes.
Concretely, auto mode earns its keep when:
- The task has many small steps — a refactor, a migration, a batch of files — where prompting turns a ten-minute job into forty minutes of clicking.
- You’re running something long and don’t want it stalled waiting for you.
- You’re using subagents, which now run in the background by default; a background task blocked on a prompt you haven’t seen is just a stalled task. (Permission prompts from background subagents do surface in your main session rather than being auto-denied.)
- The work is in a recoverable place — version control, a copy, a sandbox — where a mistake costs minutes rather than a client relationship.
When to keep the prompts on
Equally honest about the other direction. Stay in Ask-permissions mode when:
- You’re new. The first week, the interruptions are the curriculum.
- The work is irreversible. Sending, publishing, posting, deleting things without a copy. A classifier reasons about danger in general; only you know that this particular email goes to the entire client list.
- You’re in unfamiliar territory — a system you don’t know well enough to notice a wrong action if you saw it.
- The stakes are regulatory. If a mistake is a compliance incident rather than an inconvenience, the extra friction is the point.
And a specific one worth calling out: if a session is reading untrusted external content — a document from outside, arbitrary web pages — that’s not the session to hand more autonomy to. Content can be crafted to influence a model, and the approval gate is your defence. More on that risk here.
Auto mode and plan mode are not rivals
A common confusion, worth clearing up because they’re frequently discussed as alternatives.
Plan mode answers “should we do this?” Claude investigates and proposes an approach without changing anything, and you agree the plan before work starts.
Auto mode answers “do I need to watch every step?” It’s about the execution, not the decision.
They compose, and the combination is the most productive way to work: plan first, then let it run. You spend your attention on the decision — where your judgement is worth the most — and stop spending it on forty individual confirmations of a plan you already approved. Our side-by-side comparison covers this in more detail.
Where it’s available
Auto mode runs on Pro, Max, Team, and Enterprise plans. It’s also available on third-party providers — Amazon Bedrock, Google Cloud’s Agent Platform, and Microsoft Foundry — and no longer needs a special opt-in environment variable there, which matters for enterprises whose deployment routes through their own cloud account.
The mindset shift
The instinct that more prompts means more safety is intuitive and mostly wrong. Safety comes from three things, in this order: scope (what Claude can reach at all), reversibility (can you undo it), and review (does a human check the output before it leaves the building).
Permission prompts are a fourth line of defence, and a weak one, because they degrade with repetition. A human approving their fortieth prompt is not performing a safety check — they’re performing a ritual.
Auto mode is worth understanding as an admission of that. It moves the check somewhere it doesn’t get tired, and keeps your attention for the two decisions where it actually counts: what to do, and whether the result is right.