Claude Code Permission Modes: When to Run Hands-Off with Auto Mode — Transcript

Full transcript

1. 0:02Permission modes let you decide once
2. 0:04what's safe to run without you. You
3. 0:06already cycle through several of them
4. 0:07with shift tab, manual, accept edits,
5. 0:09and plan.
6. 0:10>> [music]
7. 0:10>> The rest are where hands-off Claude code
8. 0:12lives, and the one to lead with is auto.
9. 0:15Claude runs without prompts while a
10. 0:16separate classifier reviews each action
11. 0:18before it executes, stepping in on ones
12. 0:20it identifies as dangerous.
13. 0:23So, here are the permission modes.
14. 0:25First, we have manual, which reads only
15. 0:27without prompting. Everything else asks.
16. 0:29Accept edits reads file edits in common
17. 0:31file system, bash commands. This is for
18. 0:33iterating on code that you review after
19. 0:35the fact. Plan read only, it researches
20. 0:38and proposes without editing. Auto mode
21. 0:40accepts everything with a classifier
22. 0:42model reviewing each action before it
23. 0:44runs. Don't ask, only pre-approved tools
24. 0:46allowed, everything else auto denied
25. 0:48with no prompt. This is great for your
26. 0:50CI pipelines. And then bypass permission
27. 0:53skips all check. This is equivalent to
28. 0:54the dangerously skip permissions, only
29. 0:57run it inside of an isolated container
30. 0:59or virtual machine. Press shift tab to
31. 1:01cycle through manual, accept edits,
32. 1:03plan, and auto. The status bar shows
33. 1:05which one that you're in.
34. 1:07Auto mode is where Claude runs, but
35. 1:08before each action executes a separate
36. 1:11classifier model reviews it. The
37. 1:12classifier guards intent. It blocks the
38. 1:15moves that escalate beyond your request,
39. 1:17production deploys and migrations, force
40. 1:19pushing or piping download code into a
41. 1:21shell, sending sensitive data to
42. 1:23external endpoints, and destroying files
43. 1:25that exist before the session. It allows
44. 1:28the everyday work, local edits in the
45. 1:30project, installing dependencies from
46. 1:31your lock file, read only requests, and
47. 1:33pushing to your own branch. Now, the
48. 1:35classifier won't catch whether the code
49. 1:37works or not. So, if you ask Claude to
50. 1:39refactor authentication and it writes
51. 1:41broken authentication, the classifier
52. 1:43waves it through because broken isn't
53. 1:45dangerous. Use auto mode together with a
54. 1:47stop hook that runs your tests. Auto
55. 1:49mode watches what Claude is trying to
56. 1:50do, while the hook confirms that the
57. 1:52code actually runs. Auto mode's
58. 1:53guardrails are still evolving, so check
59. 1:55the docs for the current block and allow
60. 1:57lists.
61. 1:58Don't ask is the right move whenever no
62. 2:00human is there to approve prompts. CI,
63. 2:03scheduled jobs, overnight batches.
64. 2:05Anything off that list gets auto denied.
65. 2:07So, your pipeline keeps moving instead
66. 2:09of hanging on an approval no one will
67. 2:10give.
68. 2:15There are several permission modes and
69. 2:16you can reach the everyday ones by
70. 2:18cycling shift tab. Auto is the hands-off
71. 2:20default. The classifier checks intent
72. 2:22before each action runs and a stop hook
73. 2:25checks correctness after.
74. 2:27Don't ask covers unattended pipelines
75. 2:29and bypass [music] permission belong
76. 2:30only inside isolated containers and VMs.
77. 2:33Match the mode to the job.