A Claude Code permission mode decides which actions the agent may take without stopping to ask. There are four: plan reads but changes nothing, default asks before edits and commands according to your permission rules, acceptEdits applies file edits without asking but still asks about commands, and bypassPermissions asks about nothing. Picking one is a statement about how much you trust the agent in this directory.
That statement gets more complicated as soon as the person typing the request is not the person who owns the machine. This post explains the modes as Claude Code defines them, then what changes in a shared room.
The four modes
plan. The agent reads files, searches and reasons, and produces a plan. It does not edit or run anything. This is the mode for “tell me what you would do” and for letting someone explore a codebase they should not be able to change.
default. The agent asks before each edit and each command, unless your permission rules already allow that specific tool or pattern. Good for pairing, where you are watching and each prompt is a real decision.
acceptEdits. File edits go through without a prompt; commands still ask. Useful in a repository where reverting a bad edit is cheap (it is under version control) but running the wrong command is not.
bypassPermissions. Nothing asks. Anthropic’s guidance is to reserve this for sandboxed, disposable environments, because a mistaken or injected instruction runs with your full local authority.
The ladder from plan to bypassPermissions, and the four actions that pause regardless of mode when the agent is shared.
Why modes are about directories, not people
A permission mode is set for a session, which in practice means for a working directory. That is the right unit when you are alone: the docs repo can run in acceptEdits, the infrastructure repo in default, a throwaway experiment in bypassPermissions.
It stops being sufficient when a second person can send requests. Their request runs with the mode of your session. A co-founder who only needs to read the code is now editing it because you set acceptEdits for yourself last week. There is no per-person dimension in the mode itself.
What changes in a room
In a muti room the agent still has a Claude Code permission mode, chosen when you create the agent for a directory. Two things sit on top of it.
Per-person permission. Each request from someone other than the owner is either approved once, or covered by a standing “always allow” you granted that person for that agent. You can revoke the standing grant at any time; queued requests from that person are cancelled.
Four actions that always pause. Whatever the mode and whatever the grant, pushing to a shared branch, deleting, spending money and touching credentials stop for the owner. Even an agent in bypassPermissions pauses here when the request came from someone else. The reasoning is in four actions an agent should always ask before doing.
A practical mapping
- Exploration for others: create the agent in
plan. Guests can ask questions, nothing changes on disk. - Everyday work with people you trust:
acceptEdits, with a standing grant for those people. Commands still ask; the four actions still pause. - Your own throwaway sandbox:
bypassPermissionsis fine because nobody else is in the room. The moment you invite someone, reconsider. - Anything with production credentials in the directory:
default, no standing grants, and a separate agent for the parts that do not need those credentials.
Frequently asked questions
Does a room override Claude Code’s mode? No. The mode still governs what the agent does within a run. The room adds who may start a run and which actions pause regardless.
Can a requester choose the mode? No. The owner chooses it per agent. Requesters can ask for read-only behaviour in their request, and the owner can answer an approval with “continue read-only”.
Is bypassPermissions ever acceptable for a shared agent? Only for directories where nothing irreversible can happen, and even then the four actions pause. A separate post covers why bypassPermissions is fine for you and dangerous for everyone else.
What about Codex? Codex has its own approval settings with a similar shape. In a room the per-person grants and the four always-pause actions apply the same way.
Set the mode for the directory, set the grant for the person, and let the four actions ask. That is the whole model. Give your agent a room to see it in practice.
Published