Permission modes
New sessions start in bypassPermissions, where nothing asks for approval; !mode changes one session and PERMISSION_MODE all new ones
A session’s permission mode decides which tool calls the agent makes without asking. A call that needs permission appears in the thread as a prompt (see Approvals, questions and plans).
Modes
| Mode | !mode argument | Behaviour |
|---|---|---|
bypassPermissions | bypass, yolo | Nothing asks for approval. The default. |
default | default, ask | Tool calls that need permission ask first. |
acceptEdits | accept, acceptedits, edits | File edits run without asking; other tool calls that need permission ask. |
plan | plan | The agent investigates and presents a plan for review before changing anything. |
auto | auto | Claude Code’s auto mode: the harness decides per call whether to ask. |
These are Claude Code’s permission modes: Claude Code defines which calls each one lets through.
Outside bypassPermissions, spawn_thread and post_thread ask for approval; read_thread never asks.
The Codex harness supports default and bypassPermissions only.
Default
A new session starts in bypassPermissions. To change that for sessions created from then on, set PERMISSION_MODE in the gateway’s environment (in one-machine mode, the process’s). See Configuration.
Changing a session’s mode
!mode plan| Set by | Mode |
|---|---|
!mode <argument> | The named mode. Applies at once, including to a running turn. |
| “Approve · auto-accept edits” on a plan | acceptEdits |
spawn_thread | The new session starts in its parent’s mode. |
- The mode survives a runner restart and idle exit.
- Anyone whose messages are delivered to the session can change it (see Shared threads).
- The turn footer and
!statusshow the mode only when it is notbypassPermissions.