On a freshly installed Claude Code with nothing configured, you ask it to read a config file, then to fetch a page with curl, then to delete a build directory. Which of those is it most likely to carry out without asking?

The principle — sort the action by what it changes and where its input comes from. Reading something already on your disk is the only one of the three that neither writes nor pulls in anything new.

Why the key is correct — reading is the category that goes unasked whichever mode you are in, and that is what makes it a safe prediction. In Manual mode, Claude Code runs a built-in set of read-only commands such as ls, cat, and git status without asking. In auto mode, read-only actions and file edits in your working directory are auto-approved, except writes to protected paths. The other two leave that category by different routes. Deleting a build directory modifies your system, so it is either put to you or sent to the classifier. The fetch is the interesting one: it changes nothing on disk, yet commands that fetch content from the web such as curl and wget are not auto-approved by default, because the risk is what the response carries rather than what the command writes.

Why the others are wrong — treating the fetch as harmless because it is read-shaped misses that its input is untrusted. Expecting all three to run inverts the arrangement. And a prior approval cannot exist on a fresh install.

Remember this — reading what you already have is free. Touching your system or pulling from the network is not, and no amount of leaving things unconfigured changes that.

Sources — Anthropic's Claude Code security and permission-modes pages.