Claude Code permissions: what auto mode still asks you, and how to answer it by voice

Every Claude Code CLI user knows the prompt. Run this command? Edit this file? Push to the remote? Recent versions start in auto mode, which clears the routine ones with a background classifier, and the usual advice for the prompts that remain is to allowlist more, or to start the CLI with the flag whose name begins with "dangerously". The speed is real. So is what you give up: you no longer see what the agent is about to do. This post lays out what the modes and rules actually do, which prompts you still get in auto mode and why those are the ones worth keeping, and a way to answer them without the keyboard.

The modes, honestly

The Claude Code CLI has six permission modes. The names below are the ones you pass to --permission-mode or set as permissions.defaultMode in ~/.claude/settings.json:

• auto — the mode a new terminal or VS Code session starts in since v2.1.283 (earlier versions start in it only on the Pro, Max, Ultra and Team plans). No routine prompts: before shell commands or network requests run, a background classifier checks that they fit what you asked for. Anything it isn't sure about still prompts.
• default — despite the name, no longer the default. Prompts the first time each tool is used; reads are free. Labeled "Manual" in the CLI.
• acceptEdits — auto-approves file edits and everyday filesystem commands such as mkdir, touch, mv and cp inside the working directory. Shell commands and network access still prompt.
• plan — read-only exploration. The agent reads files and runs read-only commands but doesn't change your source.
• dontAsk — auto-denies anything that would have prompted. Useful for scripted runs where a prompt would just hang.
• bypassPermissions — skips the prompts. Starting the CLI with --dangerously-skip-permissions is the same thing. Anthropic's docs are blunt about it: "Only use this mode in isolated environments like containers or VMs where Claude Code can't cause damage." It also skips prompts for writes to protected paths such as .git and .claude.

Shift+Tab cycles the common ones: from auto, the first press goes to default, then acceptEdits, then plan. Bypass only appears in the cycle if you enabled it on purpose.

Allow rules: the prompts you never needed

Most of the interruptions aren't decisions at all. They're the same twelve commands you'd approve every time. Those belong in rules, not prompts. Rules live under permissions in the settings file and are evaluated in a fixed order: deny first, then ask, then allow. The first match wins, and a broad deny beats a narrow allow.

{
  "permissions": {
    "allow": ["Bash(npm run *)", "Bash(git commit *)", "WebFetch(domain:docs.example.com)"],
    "deny": ["Bash(git push *)", "Read(./.env)"]
  }
}

A few things worth knowing: Bash(git *) allows every git command, so put the wildcard after the subcommand you mean. A rule for safe-cmd * doesn't cover safe-cmd && other-cmd. When a prompt offers "Yes, and don't ask again", the rule it saves lands in .claude/settings.local.json. And /permissions opens a dialog that lists every rule and which file it came from, even while the agent is working.

Between a good allowlist and auto mode, the routine prompts mostly disappear. That's the right outcome, and you should do it.

The prompts you keep are the ones that hurt

Here's the part the "just skip permissions" advice gets wrong. In auto mode, with the routine allowlisted, what's left is the set of prompts the classifier deliberately kept for you: pushing to a remote, deleting things, running a migration, touching a secrets file, an unfamiliar command it wasn't sure about. Those are precisely the moments where review earns its keep.

They are also the moments that drag you back. The agent stops, and until you read the command and press a key, nothing moves. If you're reviewing a design doc, you don't notice for a while. If you run several agents in parallel, two of them stop at once and you're back to tab-juggling. The honest options were "skip them" or "babysit the screen". That's a bad pair.

Answer them by voice

Verbative adds a third option. It sits around the Claude Code CLI in VS Code, and when a permission prompt appears it reads the prompt aloud — the tool, and what the agent is about to do — and listens for your answer:

• "approve" or "deny" act on the prompt, exactly as if you'd pressed the key.
• "explain" gives you a spoken explanation of the request first, so you can decide on something more than a command string.
• "update" gets you a spoken status check on what the agent is doing right now, and "stop claude" aborts the run.

With more than one agent, each prompt is attributed to the agent that asked, and each agent's status bar shows whether it is working. You hear the request, you decide, and you never left the couch, the whiteboard, or the other window.

This isn't instead of the CLI's own machinery. Keep auto and your allowlist for the routine; let voice handle the prompts that remain. Dictation and wake-word detection run on your machine with whisper.cpp, the voice is generated locally, and it all runs on your existing Claude Pro or Max subscription through the Claude Code CLI — no API key. macOS and Windows.

A sane setup in three steps

1. Allowlist the routine. Your package scripts, your test runner, commits. Deny the handful of things you never want automated, such as git push or reading .env.
2. Stay in auto, the mode you start in. Save bypass for a container you can throw away.
3. Answer what's left by voice. Every prompt that still appears is one you wanted to see. Hear it, say approve or deny, keep working.

The voice docs list every command, and the configure docs cover how Verbative hooks into the CLI.

Frequently asked

Is dangerously-skip-permissions safe to use?+

Anthropic's own docs say to use bypass mode only in isolated environments such as containers or VMs where the agent can't cause damage. It skips every prompt, including writes to protected paths like .git and .claude, so on a normal workstation it trades all visibility for speed.

Is auto mode the default in Claude Code?+

Yes. Since v2.1.283, terminal and VS Code sessions start in auto mode; earlier versions start in it only on the Pro, Max, Ultra and Team plans. It removes routine prompts and runs a background classifier that checks shell commands and network requests against what you asked for; actions it is unsure about still prompt. The mode literally named default is the older manual mode.

How do I let Claude Code run npm scripts without asking every time?+

Add an allow rule under permissions in your settings file, for example Bash(npm run *). Rules are evaluated deny first, then ask, then allow, and the /permissions command shows every active rule and the file it comes from.

Can I approve Claude Code permission prompts by voice?+

Yes, with Verbative in VS Code. Each prompt is read aloud with what the agent is about to do, and you say approve, deny, or explain to hear more first. It works alongside the CLI's own modes and allow rules.

Does voice approval work when several agents run at once?+

Yes. In Verbative's Agent Workspace each prompt is attributed to the agent that asked, every agent has its own working status bar, and you can switch who you are talking to by voice.