bypassPermissions is the Claude Code permission mode in which the agent never stops to ask: edits, commands, network calls and everything else run as soon as the model decides to run them. Anthropic’s guidance is to use it only in sandboxed, disposable environments. That guidance is about what the agent can reach. There is a second question it doesn’t cover: who is telling it what to do.
For your own agent in your own sandbox, bypass is a speed setting. For an agent other people can send requests to, bypass is a decision to give those people your full local authority with no human in between. This post is about the difference.
Why bypass is tempting
Prompts are friction. In a long refactor, a hundred “allow this edit?” questions train you to press yes without reading. Turning them off makes the agent feel like a colleague instead of a form. Many people run bypass on repositories under version control and reason, correctly, that a bad edit is a git checkout away.
The reasoning holds as long as three things are true: you wrote the request, you are watching, and nothing irreversible is in reach.
What changes when someone else asks
The request is not yours. A teammate’s “clean up the old branches” means something to them. It means git branch -D to the agent. With bypass, nothing pauses between the two.
The input is not trusted. Requests arrive with attachments: a screenshot, a log file, a pasted issue. Any of them can contain text that reads like an instruction. Prompt injection through shared inputs is a real vector, and bypass removes the only checkpoint that would catch it.
You are not watching. Sharing exists precisely so the agent works when you aren’t there. A prompt you would have answered in a second becomes an action nobody saw.
Irreversibility is in reach. Pushing to main, deleting, spending, reading a credential. On your own machine these are rare in a normal session, which is why bypass feels safe. They are exactly the actions someone else is most likely to trigger by accident.
The line
Use bypass for agents only you talk to, in directories where nothing irreversible lives. The moment an agent is in a room with a second person, the question is no longer “how much do I trust the model” but “how much do I trust every person and every attachment that can reach it”.
Keeping the speed without crossing it
A room lets you keep most of the speed with two additions on top of the mode.
Per-person grants. A standing grant lets a trusted person run without per-request approval. The agent’s own mode can stay permissive for the ordinary calls. See permission modes, explained.
Four actions that always pause. Pushing to a shared branch, deleting, spending money and touching credentials stop for the owner, even in bypass, when the request came from someone else. A hundred ordinary edits run unprompted; the one git push origin main waits for you. The reasoning is in four actions an agent should always ask before doing.
A practical recommendation
- Agents you share:
acceptEditsfor repositories,planfor anything exploratory. Grant the people you trust. - Agents only you use in disposable sandboxes: bypass is fine.
- Anything with production credentials in its working directory:
default, and a separate agent for the parts that don’t need them. - Never share an agent whose working directory contains a key file. Move the key, not the mode.
Frequently asked questions
Does a room change what bypass means inside a run? No. Within a run, bypass still means no runtime prompts. The room adds who may start a run and which four actions pause regardless.
What about Codex’s equivalent settings? Same shape, same advice: permissive for yourself in a sandbox, not for a shared agent.
Isn’t a prompt for every push annoying? Pushes to shared branches are rare in a normal session. If they aren’t, the agent’s working directory is probably too broad.
Fast for you, careful for everyone else. That is what a room is for. Give your agent one.
Published