Every session runs in one of four modes. You choose it when you start and you can change it at any time, including mid-turn.
| Mode | What it means |
|---|---|
| Plan | Research and propose only. No edits, no commands. |
| Ask | Approve every tool use. |
| Auto | File edits apply without asking. Commands and anything outside the worktree still prompt. |
| Bypass | Nothing asks. Use only when you trust the whole task. |
Auto is about containment, not tool type
This is the part worth reading twice, because the obvious reading is wrong.
Claude Code's own accept-edits behaviour silences file edits and nothing else, so a session on it
still stops at every single shell command. That is not what a mode called Auto says on the tin, and
in practice it means you sit there approving ls.
So in Auto, Fleet allows without asking. The line it holds instead is containment: anything the agent tries to touch outside its own worktree still prompts you. A write into your home directory, a read of a path outside the checkout, anything the SDK reports as blocked by path: those stop and wait, in Auto exactly as in Ask.
That is the real difference between Auto and Bypass. Under Bypass the permission callback is never invoked at all, so nothing checks anything, including containment.
Two things nothing ever answers for you
Whatever the mode, and including Auto:
- A plan is yours to approve. Approving a plan is a decision about what happens next, by
definition, so
ExitPlanModealways stops and waits. - A question is yours to answer. When an agent asks you something, the answer is not a tool result the model can fill in. It comes back from you or the turn does not continue.
Bypass is the exception in that it silences the permission prompt, but a plan gate and a question are not permission prompts. In a squad, an agent asking the user a question still reaches you.
What a permission card shows
The tool, its arguments rendered as the thing it is rather than as raw JSON, and the choice. Fleet has a card per tool it knows about, and an unknown tool renders through a generic card that is still readable, because the tool list grows and a JSON dump is not an interface.
If you walk away
By default there is no timeout on a permission request. An agent waiting overnight for approval is fine, and a request that quietly expired into a refusal would be worse. You can set a timeout in Settings if you want one.
When a session ends while something is pending
Every blocking prompt settles on every path: you answer it, you interrupt, you close the session, or you quit the app. This matters more than it sounds. A query blocked on a promise cannot process its own interrupt, so a prompt that failed to settle would be an app you could not close.
Which mode to actually use
- Plan for anything where you want to argue about the approach before code exists.
- Ask when you are learning what an agent does with your repository, or working somewhere delicate.
- Auto for normal work. The worktree is the blast radius, and Auto keeps it that way.
- Bypass when you have read the task, you trust it end to end, and you want it to finish unattended. It is a real setting, not a trap, but it does turn the containment check off.
Related: permission models for coding agents covers the general problem, and plans covers the plan gate in detail.