Before you configure any permissions, what decides what Claude Code is allowed to do?

The principle — permissions are not a blank slate that rules get written onto. A session begins in a mode, and the mode is the thing that decides whether an action runs, gets checked by something else, or stops for you.

Why the key is correct — Anthropic states it plainly: which permission mode a session starts in depends on your plan, the surface you start it from, and your settings and your organization's. The plan is the part that surprises people, because on Pro, Max, and Team plans the built-in starting permission mode is auto mode — not the mode most guidance still describes. In Manual mode, Claude Code starts with read-only permissions and asks before it edits or runs anything that changes your system. In auto mode, a separate classifier model reviews actions instead of you and blocks the ones it judges unsafe, and read-only actions and file edits in your working directory are auto-approved outright. Same install, same empty configuration, two genuinely different answers to "what is it allowed to do" — so the honest answer to the question is the mode, and then your plan.

Why the others are wrong — rules matter, but they sit on top of a mode that already exists. Approvals do not travel between sessions; configuration does. And a prompt for everything risky is a description of Manual mode specifically, not of the tool.

Remember this — check which mode you are in before you reason about what will happen. Shift+Tab cycles them, and the indicator tells you where you started.

Sources — Anthropic's Claude Code permission-modes and security pages.