Permission modes

Overview

• Permission Modes let you set safety rules for Cloud Code to run without prompts
• Cycle through modes using Shift-Tab
• Status bar shows your current mode

The Five Permission Modes

Manual

• Reads only without prompting
• Prompts for everything else

Accept Edits

• Reads file edits and common file system bash commands
• Use when iterating on code you'll review afterward

Plan

• Read-only mode
• Researches and proposes changes without editing

Auto Mode (hands-off default)

• Accepts everything with pre-execution review
• Classifier model checks each action before it runs
• Blocks dangerous actions; allows everyday work

Bypass Permission

• Skips all checks
• Only use inside isolated containers

Auto Mode Details

What the Classifier Blocks:

• Production deploys and migrations
• Force pushing or piping download code into shell
• Sending sensitive data to external endpoints
• Destroying files that exist for the session
• Actions that escalate beyond your request

What the Classifier Allows:

• Local edits in your project
• Installing dependencies from lock file
• Read-only requests
• Pushing to your own branch

Important Limitation:

• Classifier checks intent, not correctness
• Won't catch broken code (e. g. , broken authentication)
• Pair with a stop hook that runs tests to verify code actually works

When to Use Each Mode

• Auto Mode: Default for hands-off operation with safety guardrails
• Don't Ask Mode: For unattended pipelines (CI, scheduled jobs, overnight batches) where no human can approve prompts
• Bypass Permission: Only for isolated containers

Takeaways

• Permission Modes let you set safety rules for Cloud Code to run without prompts; cycle through them using Shift-Tab
• Auto Mode is the default hands-off option that uses a classifier model to block dangerous actions (production deploys, force pushes, sensitive data leaks) while allowing everyday work like local edits and dependency installation
• The classifier checks intent but not correctness, so pair it with a stop hook that runs tests to verify code actually works
• Use Accept Edits mode when iterating on code you'll review afterward, and Plan mode for read-only research and proposals
• Bypass Permission skips all checks and should only be used inside isolated containers