Permission Configuration

Configure Claude Code's permission modes to control which operations require human confirmation

Need an API key? Sign up →·Endpoints & base URLs →

Claude Code uses a permission system to control which operations require user confirmation. Configuring permissions appropriately ensures both security and development efficiency.

Permission Modes¶

auto mode and QCode: auto works through QCode. Classifier requests are sent by Claude Code itself (default model claude-sonnet-5) and count toward your usage. If you see an English notice saying "your requests go through … which isn't compatible", an interactive session holds the first action that needs review until you press Enter; set CLAUDE_CODE_AUTO_MODE_SERVER=0 to remove it. See Feature Availability.

Switching Permission Modes¶

• Press Shift+Tab to cycle through permission modes; from auto the order is auto → default → acceptEdits → plan
• To enter Plan Mode, press Shift+Tab twice from manual mode (default), or three times from auto
• Pick one at launch: claude --permission-mode acceptEdits
• Select a mode directly from the dialog

Configuring the Default Permission Mode¶

Configure in .claude/settings.json (project) or ~/.claude/settings.json (user):

{
  "permissions": {
    "defaultMode": "acceptEdits"
  }
}

Note: "defaultMode": "auto" only takes effect from the user-level ~/.claude/settings.json or your organization's managed settings. In the project's .claude/settings.json or .claude/settings.local.json it is ignored and the session uses the built-in default (not your user-level setting). bypassPermissions doesn't take effect from project settings either. The --permission-mode flag takes precedence over settings files.

Allow Rules: Pre-approving Commands¶

Pre-approve specific commands to avoid being prompted every time:

{
  "permissions": {
    "allow": [
      "Bash(npm run lint)",
      "Bash(npm run test:*)",
      "Bash(git status)",
      "Bash(git add:*)",
      "Bash(git diff:*)"
    ]
  }
}

Allow rule syntax:

• Bash(command) — exact command match
• Bash(prefix:*) — matches commands starting with the given prefix
• Read(file path) — allow reading a specific file
• Write(file path) — allow writing to a specific file

Deny Rules: Protecting Sensitive Files¶

Prevent Claude from accessing or modifying sensitive files:

{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)",
      "Write(./.git/**)",
      "Bash(rm -rf:*)"
    ]
  }
}

Deny rule syntax:

• Path patterns support * (single level) and ** (multiple levels) wildcards
• Deny rules take higher priority than Allow rules

Using Allow and Deny Together¶

{
  "permissions": {
    "defaultMode": "acceptEdits",
    "allow": [
      "Bash(npm run *)",
      "Bash(git status)",
      "Bash(git diff)"
    ],
    "deny": [
      "Bash(git push:*)",
      "Bash(rm -rf:*)",
      "Read(./.env*)"
    ]
  }
}

Configuration File Hierarchy¶

Claude Code merges permission configurations in the following priority order:

Team collaboration tips:

• Put team-wide allow/deny rules in .claude/settings.json and commit it to Git
• Put personal-specific settings in .claude/settings.local.json and add it to .gitignore

Best Practices¶

1. Protect sensitive credentials

{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./credentials/**)",
      "Read(./.ssh/**)"
    ]
  }
}

2. Frontend project configuration

{
  "permissions": {
    "defaultMode": "acceptEdits",
    "allow": [
      "Bash(npm run dev)",
      "Bash(npm run build)",
      "Bash(npm run test:*)",
      "Bash(npm run lint:*)"
    ]
  }
}

3. CI/CD automation

Since Claude Code 2.1.285, claude -p and the Agent SDK start in auto when no permission mode is set in sessions that can't fetch feature flags. Connecting to QCode with ANTHROPIC_AUTH_TOKEN gives Claude Code no credential to fetch them (the same holds for CI containers that start fresh every run), so this is your CI's default. In CI, set the mode explicitly. We recommend dontAsk with an allow list: only actions that need no approval and the listed tools run, everything else is denied.

claude -p "Run the tests and fix failures" \
  --permission-mode dontAsk \
  --allowedTools "Read,Edit,Bash(npm test)"

Or in the project settings:

{
  "permissions": {
    "defaultMode": "dontAsk",
    "allow": ["Read", "Edit", "Bash(npm test)"]
  }
}

⚠️ Warning: bypassPermissions mode skips all security checks. Only use it in fully isolated, trusted environments (such as a throwaway container).

Enterprise →