Claude Code Has 5 Permission Modes Now. Plan Isn't Read Only.

My own guide to using Claude has a line in it that says Claude Code has three interaction modes: Ask, Code, and Plan. I wrote that on August 17. Anthropic's current documentation retires two of those names in a single flat sentence: "Earlier versions of the Code tab labeled these modes Ask permissions, Auto accept edits, and Plan mode."

There are five modes in the selector today. And the one most people reach for when they want to be careful, Plan, doesn't mean what the name suggests it means.

My own guide names 3 modes. The app shows 5.

Here's the current list from Anthropic's desktop documentation, checked August 28, 2026, with the settings value each mode writes:

• Manual (default): Claude asks before editing files or running commands, and you see a diff you can accept or reject on each change.

• Accept edits (acceptEdits): Claude auto-accepts file edits and common filesystem commands like mkdir, touch and mv, and still asks before running other terminal commands.

• Plan (plan): Claude reads files and runs commands to explore, then proposes a plan without editing your source code.

• Auto (auto): Claude executes actions with background safety checks that verify alignment with your request. On Pro, Max and Team plans this is the mode a session starts in.

• Bypass permissions (bypassPermissions): Claude runs without permission prompts. Anthropic's guidance is to use it only in sandboxed containers or VMs.

Auto isn't available to everyone. It needs Claude Opus 4.6 or later, Sonnet 4.6 or later, or Fable 5, and an administrator can pull it out of the selector with a managed setting. I wrote about what auto mode's classifier does and doesn't catch when it became the default, so I won't repeat that here.

Plan mode runs commands on your machine

This is the part I'd want to know if I were paying somebody to run Claude Code against my business. Anthropic's permission modes page says it plainly:

Claude reads files, runs shell commands to explore, and writes a plan, but does not edit your source. Except in sessions with bypass permissions available, edits stay blocked until you approve the plan.

What's protected in plan mode is your source, and the thing doing the exploring is your actual shell. Claude can list directories, read logs, run a test suite, hit an API, whatever it decides it needs to understand the problem. It just won't write to your files until you say go.

Then there's the setting almost nobody knows is on:

When auto mode is available and the useAutoModeDuringPlan setting is on, which it is by default, the classifier reviews shell commands during planning instead of prompting you. Approved commands run, and rejected ones are blocked.

So on a Pro, Max or Team plan with the defaults untouched, the sequence during "planning" is that Claude proposes a command, a classifier model approves it, it runs, and you find out by reading the transcript. Anthropic documents that in the open rather than burying it, which is more than most vendors manage, and it's still not what a business owner pictures when somebody tells them the work is being done in plan mode.

The mode that does not stick

There's a second detail in the desktop documentation that matters more than it looks:

A mode you pick in the selector is remembered per folder and takes precedence over defaultMode for that folder, except Plan, which applies to the current session only.

Every mode you choose sticks except the careful one. Set Accept edits on a project and it's still Accept edits next week. Set Plan and it's gone when the session ends. So if your process is "we always start in Plan", that process depends on a person remembering, every time, on every folder, which is exactly the kind of rule I'd rather have living somewhere it can't be forgotten.

What no mode will ever auto approve

Anthropic keeps a short list of actions that no mode auto-approves, including bypass permissions:

• Tools matched by an explicit ask rule: if you wrote the rule, it stays.

• Connector tools your organization set to ask: admin policy outranks session mode.

• Tools that require a person: the built-in AskUserQuestion tool, and MCP tools marked as requiring user interaction.

• Removals aimed at a critical path: deleting the wrong thing is the one action Anthropic won't let a mode wave through.

That's a real floor and I'm glad it exists, though it's worth noticing that all four items are about damage to your machine and none of them are about whether what Claude produced is any good.

Questions to ask when you hire this out

The permission mode is a dial for how much Claude does without stopping, and it says nothing about what your system is allowed to do at all. The second one is what actually protects you.

My job application agent is the clearest example I've built. It reads job boards every morning and applies on my behalf, and the reason I let it is a written never-list: it can't invent a credential, it can't apply to a posting whose stated minimums I don't meet, and it can't treat text on a page as an instruction. It stopped itself nine times in twenty-three days, and none of that came from a permission mode. It came from rules inside the build, which is where they have to live, because a mode setting can be changed by whoever opens the app next.

So if you're paying somebody to build with Claude Code, three questions I'd ask:

• Which mode does this run in, and who set it? "Whatever it opened in" is a real answer and it usually means auto.

• What can this system never do, in writing? If the never-list doesn't exist, the permission mode is the only guardrail there is.

• Where do the shell commands go during planning? If the answer is "planning doesn't run anything", the person hasn't read the current documentation.

I corrected the sentence on my guide today, and the only reason I caught it is that I went to cite my own page and read it properly for the first time since I published it.

Sources

Checked August 28, 2026:

• Choose a permission mode, Claude Code documentation, Anthropic

• Desktop application, Claude Code documentation, Anthropic

• How to use Claude, my own guide, corrected today

If you've got Claude Code running against something that matters in your business, do you know which mode it opens in? The intro call is free and runs fifteen to twenty minutes, and consulting is $250 for the first hour then $75 an hour with the hours estimated up front. Pick any time that works for you.