Claude Code for Beginners – Part 2: Plan Mode and Permissions

Okay — by now it’s running, and it’s done something useful for you. And if you’re anything like me, your very next thought was: hold on, what stops this thing doing something I didn’t ask for?

Fair question. It’s the one I want to answer today, and most of the answer turns out to be one key on your keyboard.

Shift+Tab is the whole trick

Claude Code has a handful of permission modes. They decide how much it does without checking with you, and Shift+Tab moves between them mid-session. The status bar at the bottom always tells you where you are.

Honestly, the fastest way to get this is to open a session and press Shift+Tab four or five times while watching that bar. Here’s what you’re cycling through:

That last part catches people out. If you’re on Pro, Max or Team, your terminal sessions start in auto mode, not manual. So if it’s felt suspiciously relaxed about asking you things — that’s why. Your first Shift+Tab drops you into manual, and from there it just loops.

The modes, in plain words

There’s a sixth one called dontAsk, but it never shows up in the cycle and it’s really a CI thing. You can forget it exists.

The table tells you what each mode allows. What it can’t show you is how differently the same moment plays out depending on where you’re sitting:

Plan mode is where I’d start

If you take one thing away from this post, take this one. Plan mode lets it read everything and change nothing.

Get into it with Shift+Tab, or put /plan in front of a single prompt, or start the whole session in it:

claude --permission-mode plan

It goes off, reads your files, pokes around, and comes back with a plan — a written description of what it intends to do. Your source is untouched the whole time. Then it asks:

⏺ Read src/server.ts, src/routes/public.ts
⏺ Read package.json
 
  Here's my plan:
  1. Move the rate limiter into middleware
  2. Wire it into the two public routes only
  3. Add a test for the 429 path
 
Would you like to proceed?
❯ 1. Yes, and use auto mode
  2. Yes, manually approve edits
  3. No, keep planning

Option 3 is the one worth knowing about. Arguing with a plan costs you thirty seconds. Undoing a bad change costs a lot more than that. I use it constantly — usually to say “yes, but don’t touch the migrations” or “just do the first two steps.”

Two smaller things while you’re here. Ctrl+G opens the plan in your editor, so you can fix it yourself instead of describing the fix. And pressing Shift+Tab again backs out of plan mode without approving anything at all.

Don’t just hit yes

I’ll be honest with you: I have absolutely rubber-stamped things I should have read properly. Everyone does. The prompt appears, you’re mid-thought, you hit 1.

So here are the two habits that actually saved me, and neither of them is a setting.

Commit before you hand over anything big. Then git diff is your undo button and you can afford to be relaxed about the rest.

Run /diff before you accept a pile of work. Seeing everything uncommitted in one go is much easier than judging fifteen prompts one at a time, half-distracted.

And when you do read a prompt, the things worth actually looking at are: which file, which command, and whether it’s reaching outside the project at all.

Answer the boring ones once

Some approvals you are never going to say no to. Running the test suite. Checking git status. Rather than answering those forever, run /permissions and pre-approve them — or block the things that should never happen:

{
  "permissions": {
    "allow": ["Bash(npm test)", "Bash(git status)"],
    "deny": ["Bash(sudo *)"]
  }
}

Deny rules win in every mode, including the reckless ones. And plain read-only commands like ls, cat and grep never prompt anyway, so don’t bother listing those.

⚠️ bypassPermissions skips every check there is. It’s built for throwaway containers and CI, not for the laptop your actual work lives on. If a tutorial opens by telling you to turn it on, close the tutorial.

Making plan mode stick

If you want one project to always start in plan mode, drop this into its .claude/settings.json:

{
  "permissions": {
    "defaultMode": "plan"
  }
}

One gotcha worth knowing, because otherwise it’ll cost you an afternoon: "auto" and "bypassPermissions" are quietly ignored from project settings files. Those two only work from your own ~/.claude/settings.json. So if you set one and nothing happened, that’s why — nothing’s broken.

Next time

Part 3 is about CLAUDE.md, the file that stops you explaining your own project from scratch every single session. It’s probably the highest-value half hour you’ll spend on any of this.

In the meantime, go and live in plan mode for a week. I think you’ll like it there. 🙂