Permissions and safety: let agents act without losing control
Permission modes, allow, ask and deny rules, managed settings, the Bash sandbox, secrets, network egress and prompt-injection defences for Claude Code and similar agents, with safe default configurations you can copy.
On this page
An agent with a shell can do anything your account can. Three layers keep that power useful: permissions decide what the agent may attempt, the sandbox decides what an attempt can reach, and audit logs tell you what happened. Set up all three, because each one covers the others' blind spots.
What it is#
Claude Code checks every tool call against several layers. Only some of them are enforced:
| Layer | What it does | Enforced |
|---|---|---|
Instructions (CLAUDE.md, the prompt) | Tell the agent what you want | No. The model tries to follow them |
| Permission mode | Sets what runs without asking | Yes |
| Allow, ask and deny rules | Pre-approve, force a prompt or block specific calls | Yes. Deny wins in every mode |
| Hooks | Your script inspects each call and can block it | Yes, for the calls it sees |
| Sandbox | The operating system limits which files and hosts shell commands can reach | Yes, for Bash and its child processes |
| Outer isolation | A container, VM or dev container around the whole process | Yes, for everything inside it |
| Audit trail | OpenTelemetry events and hook logs record decisions | Records, does not block |
Claude Code has six permission modes. Press Shift+Tab to cycle through them in the CLI:
| Mode | Runs without asking | Use it for |
|---|---|---|
default (shown as Manual) | Reads only | Sensitive work, unfamiliar code |
acceptEdits | Reads, file edits and common filesystem commands such as mkdir and mv | Iterating on code you review as it changes |
plan | Reads, plus classifier-approved commands when auto mode is available | Exploring before any change |
auto | Everything, with a classifier model checking actions first | Long tasks where you trust the direction |
dontAsk | Reads in your working directories and pre-approved tools; everything else is denied | CI and scripts with an exact allowlist |
bypassPermissions | Everything | Isolated containers and VMs only |
With Claude Code v2.1.283 or later, auto is the starting mode for interactive terminal and VS Code sessions, on every plan. Its classifier blocks actions that go beyond your request, target infrastructure it does not recognize, or look driven by hostile content Claude read: piping a download into a shell, force pushes, production deploys, mass deletions, printing live credentials and dozens more. It also pauses and falls back to prompting after 3 blocks in a row or 20 in a session. It reduces prompts; it does not guarantee safety. claude -p and Agent SDK runs start in default in most setups.
Some things no mode approves on its own, not even bypass: calls matching an explicit ask rule, MCP tools their server marks as needing user interaction, and rm or rmdir aimed at critical paths such as /, your home directory or the working directory.
When to use it#
Match the setup to the job and the blast radius:
| You want to | Start with | Isolation needed |
|---|---|---|
| Review every action yourself | claude --permission-mode default | None |
| Fewer prompts while you watch, no classifier | Manual mode plus the Bash sandbox in auto-allow mode (/sandbox) | The built-in sandbox on macOS, Linux or WSL2 |
| Explore a codebase first | claude --permission-mode plan | None |
| Hands-off work on a trusted task | auto, the default | A sandbox or container adds a second line |
| CI with an exact allowlist | claude -p "..." --permission-mode dontAsk --allowedTools "Bash(npm test)" "Read" | Whatever your CI runner provides |
| Fully unattended runs | --dangerously-skip-permissions as a non-root user | Required: a container, VM or the sandbox runtime |
Agents that read the web, email or tickets need extra care, because the content itself can carry instructions. The members section gives the full defence; the short version is to keep secrets out of reach, put a person in front of anything that sends or deletes, and limit where the agent can send data.
Other agents follow the same pattern. Codex combines a sandbox mode (read-only, workspace-write with the network off by default, or danger-full-access) with an approval policy (on-request, never, or a granular policy per category). GitHub Copilot, Cursor and Gemini CLI each have their own approval settings. The ideas on this page carry over; the keys do not.
Set it up step by step
Members only below this line
Get the rest of this guide free
What you get on this page:
- 1 prompt
- 2 hooks
Also in the members part
- Defend agents that read the web or email
- Keep an audit trail
- Recipes
- Patterns that work
- Mistakes to avoid
- Exercises
Sources
Checked against these on 13 Oct 2026.
- Claude Code: configure permissions (opens in a new tab)code.claude.com
- Claude Code: choose a permission mode (opens in a new tab)code.claude.com
- Claude Code: configure auto mode (opens in a new tab)code.claude.com
- Claude Code: configure the sandboxed Bash tool (opens in a new tab)code.claude.com
- Claude Code: choose a sandbox environment (opens in a new tab)code.claude.com
- Claude Code: security (opens in a new tab)code.claude.com
- Claude Code: settings files and precedence (opens in a new tab)code.claude.com
- Claude Code: deploy managed settings (opens in a new tab)code.claude.com
- Claude Code: all settings reference (opens in a new tab)code.claude.com
- Claude Code: hooks reference (opens in a new tab)code.claude.com
- Claude Code: monitoring and audit events (opens in a new tab)code.claude.com
- Claude Code: CLI reference (opens in a new tab)code.claude.com
- Claude Code: development containers (opens in a new tab)code.claude.com
- Claude Agent SDK: securely deploying AI agents (opens in a new tab)code.claude.com
- Codex: agent approvals and security (opens in a new tab)learn.chatgpt.com
- MCP security best practices (opens in a new tab)modelcontextprotocol.io