Permissions & Settings

Interactive sessions now start in auto mode by default: a classifier judges each action and blocks the dangerous ones instead of prompting you for everything. The default arrived in steps. From 2026-08-14 it covered new sessions on Pro, Max and Team; since 2.1.284 (2026-09-28) it covers every interactive terminal and VS Code session on every plan and provider, whenever no permission mode is configured. Since 2.1.285, claude -p and Python Agent SDK runs on third-party providers or with telemetry off start in auto mode too. permissions.defaultMode (or --permission-mode) still overrides it. Before auto mode, the default stance was to ask before executing tools: Bash commands, file writes, MCP calls, URL fetches. Safe but noisy. The permission model lets you declare what's safe to run without confirmation via settings.json, either scoped to a project or applied globally across all your sessions.

The config lives in two places: .claude/settings.json at the project root (committed with your repo, shared with the team) and a user-level global file for personal defaults. Project-level settings layer on top of user-level ones. You specify allowed tools and, for Bash, specific command patterns. Claude matches these at runtime and skips the prompt for anything on the list.

How you use it day-to-day

• Allowlist read-only Bash patterns. Commands like git status, ls, cat, and test runners are safe to auto-approve at the project level. Add them to .claude/settings.json so the whole team benefits without a per-session prompt.

• Use /permissions to allowlist domains. When you paste URLs for Claude to fetch, the /permissions command is how you approve those domains so Claude doesn't stop to ask on each fetch.

• Share settings via git. Commit .claude/settings.json (and .mcp.json for MCP servers) so team members get the same approved toolset from the first clone. Don't commit your user-level file. That one is personal.

• Allow safe operations to match your risk tolerance. The official advice: allow safe operations, stay conservative on destructive ones. A lint runner or test command rarely needs human review; a rm -rf does.

• Use --dangerously-skip-permissions only in isolation. For fully autonomous runs (CI, containers, lint-and-commit scripts), this flag bypasses all permission checks. The source is explicit: only use it in containers without internet access. Don't run it in your main dev environment.

• Lean on auto mode once you trust the loop. A year after GA, Boris Cherny (Claude Code's creator) said he runs auto mode over plan mode for most work and lets routines fix bugs before he ever sees them. The bottleneck shifts from typing to oversight. Start conservative, then widen the allowlist as your confidence in the workflow grows. Anthropic's own study backs the flip: the classifier blocked 89% of dangerous commands versus 13.6% caught by humans clicking approve, and production-severity accidents fell from 6.3% of manually approved sessions to 2.4%.

• Keep manual mode for the irreversible edges. Anthropic's production guidance: use auto mode for research, long agent runs, parallel sessions, and routine cross-repo work; drop to manual or plan mode for production infrastructure, sensitive communications (email, Slack), and novel high-risk tasks. Deny the worst commands in settings so the classifier is your second line, not your only one.

• Pick an output style to match. A built-in "Concise" style (2.1.237, under Output style in /config) makes Claude lead with results and skip narration. Pairs well with auto mode, where you read outcomes rather than a play-by-play.

• Turn off commit and PR attribution in one line. "attribution": false in settings.json (2.1.281) hides all of it. Older CLI versions skip a settings file that holds the bare false entirely, so in a file older versions also read, set commit and pr to empty strings and sessionUrl to false instead.

Managed model and provider controls

For admins pinning what a fleet can run. Three of these only work from managed settings:

Setting	Where it works	What it does
availableModels	Any settings file	Allowlist of models people may pick
deniedModels (2.1.283)	Managed only	Blocks named models even when availableModels allows them; works with no allowlist too
availableModelsMatch: "exact" (2.1.283)	Managed only	Each availableModels entry allows only the version it names, so a new release stays blocked until you list it
allowedProviders (2.1.285)	Managed only	Limits which API providers a machine may use: Anthropic API, a custom endpoint, Bedrock, Mantle, Vertex AI, Foundry, Claude Platform on AWS, or a Cloud gateway
maxEffortLevel (2.1.267)	Any settings file	Caps effort on every provider; people can still pick lower

A blocked model is hidden from /model and refused by /model <name>. Naming one with --model, ANTHROPIC_MODEL or the model setting is dropped at startup and the session falls back to the Default option. A session on a provider outside allowedProviders is refused at startup, at login, and the next time it contacts the API. The exact-match switch is the one to reach for if you want to vet each new release (such as the 5.5 models) before your team gets it.

Gotchas

• Project settings are visible to everyone with repo access. Don't allowlist anything that would be a security problem if a contributor ran it automatically.
• Reducing prompts speeds things up, but so does tuning CLAUDE.md. Specific file references and a well-tuned CLAUDE.md cut down on exploratory tool calls in the first place, which matters more than approval speed.
• --dangerously-skip-permissions is not a convenience flag. The source explicitly warns it should only run in containers without internet access, not as a way to avoid prompts in a normal session.
• Allow lists are pattern-based for Bash. Overly broad patterns can auto-approve more than you intend. Be specific about the exact commands you're comfortable with.
• Auto mode does not repeal the lethal trifecta. Private data + untrusted content + an exfiltration channel is still the injection kill chain; the classifier checks that actions match your intent, but scoping which of the three an agent even has remains your job (Thariq Shihipar's framing). Opt out any time with Shift+Tab; admins can pin defaultMode or set disableAutoMode.

Practical starting point: run the fewer-permission-prompts skill (/fewer-permission-prompts in your session) to scan your recent transcripts and generate a prioritized allowlist for your project .claude/settings.json. It extracts what you've already been approving and writes the config for you.