Permissions: how much can the AI do alone?

Claude asks first

Remy asks Claude Code to clear out old art. Claude stops and shows a permission prompt:

rm -rf assets/old
Do you want to proceed?

That command deletes a folder and everything in it, with no recycle bin. Remy can answer Yes, No, or "Yes, and don't ask again" for that kind of command.

Asking every time is safe but slow. Never asking is fast but risky. A permission mode sets which actions Claude may take without asking first. In the CLI, Shift+Tab switches modes and the status bar shows the current one. Editors and the web have a mode menu.

Four modes

• ManualClaude reads files freely, but asks before editing a file, running most commands or reaching the internet. In settings files it is called default.
• Accept editsCreates and edits files in the project folder without asking, plus simple file commands like mkdir, mv, cp and even rm (delete). Other commands still ask. You review it all afterwards with git diff.
• PlanClaude reads, explores and writes a plan, but edits no code. When you approve the plan, you choose how it works next, and it starts.
• AutoNo routine prompts. A second AI model, the classifier, checks each action before it runs and blocks risky ones.

Bolt says: In VS Code, Accept edits is labelled Edit automatically. Same mode, different name.

Inside auto mode

In auto mode the classifier reviews actions instead of you. It blocks anything that goes beyond what you asked for, reaches systems it doesn't recognise, or seems driven by instructions hidden in something Claude read.

Blocked by default, for example: git push --force, git reset --hard (throws away uncommitted work), deploying to the live game, running code downloaded from the internet, and merging a pull request no human approved.

At the time of writing, new terminal sessions start in auto mode when it's available. Anthropic's own docs warn that it "reduces permission prompts but does not guarantee safety".

When a human must say yes

• Hard to undoDeleting files that were never committed, git reset --hard, a force push that rewrites shared history. A commit can be reverted. A file that was never saved is just gone.
• Reaches outsidegit push, publishing the site to Cloudflare, posting a comment. Once teammates or players see it, you can't quietly take it back.
• Spends moneyPaid services, store fees, anything with a card. Money decisions belong to the people whose money it is.
• Touches secretsReading .env, printing keys, changing who has access to the repo.

Two questions decide it. Could we undo this in a minute? Does it stay inside our project?

Pick a mode per task

• PlanBig or unfamiliar jobs, like splitting a giant file into modules. Read and fix the plan before any code changes.
• Accept editsSmall, clear jobs on a feature branch, like tuning numbers in balance.json. You read the diff afterwards.
• AutoLong, well-defined jobs on a branch with good tests, like "add tests for score.js". Review the pull request at the end.
• ManualAnything near money, secrets or the live game, like the payment code or a release.

Bolt says: Faster modes trade control for speed. The more a mistake would cost, the more control you keep.

Locks and safety nets

Modes are a starting point. Permission rules in .claude/settings.json, committed for the whole team, add exact locks:

"ask": ["Bash(git push *)"]
"deny": ["Read(./.env)"]

An ask rule forces a prompt even in auto mode. A deny rule blocks in every mode. That is the difference from CLAUDE.md, which is advice Claude reads, not a lock.

The studio habits still apply too: work on a branch, commit small save points, review every pull request, and let the robot run the tests. They are what make a faster mode safe to use.

Bolt says: Workshop rules: done. Next lesson, we use them to break our giant files into LEGO blocks.