Skip to content
Call wiki

What do Claude's permission modes actually gate, from always-ask to skip-everything?

Last updated 2026-08-17 · Confidence: documented — Claude Code’s permission docs, the auto-mode announcement, and the Cowork/connector help center; whether Cowork’s skip mode overrides a per-tool “Needs approval” is inferred.

Both surfaces run the same ladder — manual approval per action, an auto mode where a second model reviews actions instead of you, and a skip mode with no checks — and connector write actions plus org-required approvals keep prompting on every rung.

Cowork: manual, auto, skip

Section titled “Cowork: manual, auto, skip”

Cowork’s three modes:

  • Manually approve — pauses for each action.
  • Automatically approve — Claude keeps working while it reviews each action for data exfiltration and prompt injection, blocking what looks unsafe — the “another model watches” mode; it consumes extra usage.
  • Skip all approvals — no pauses, no review; earlier labeled “act without asking”.

Whatever the mode, Cowork only reads and writes folders you’ve connected — its file sandbox.

Claude Code: six modes

Section titled “Claude Code: six modes”

The permission-modes doc: Manual (default), acceptEdits (file edits and common filesystem commands in the working folder run unprompted), read-only plan, auto, dontAsk (auto-denies anything not pre-approved — for CI), and bypassPermissions (--dangerously-skip-permissions), which the docs reserve for isolated containers and VMs.

Auto’s classifier blocks actions like curl | bash, force pushes, and sending sensitive data out. Announced March 24, 2026, generally available July 10, it became the built-in starting mode on Pro, Max, and Team on August 14, 2026 — before that, sessions started in manual.

What no mode skips

Section titled “What no mode skips”
  • Connector tools an org set to ask, and MCP tools marked requiresUserInteraction, prompt in every mode — bypass included. Deny rules block everywhere too.
  • Connector write actions (send email, share or trash Drive files) ask by default; per-tool choices — Always allow / Needs approval / Blocked — persist as settings across sessions. Whether Cowork’s skip mode overrides a per-tool Needs approval is undocumented.

Admins hold the scoping levers: managed settings can disable auto and bypass org-wide; on the desktop app, bypass needs a settings toggle on Pro/Max but org policy on Team/Enterprise; owners decide whether members may set write actions to run unprompted.

Q&A from calls

Section titled “Q&A from calls”

Does skip mode stop the Asana permission prompts? The routine ones, yes — but the targeted fix is setting that connector’s tools to Always allow, which kills the prompts without dropping every other check. Approvals your org requires survive every mode.

Sources

Section titled “Sources”