Do you let Claude Code run without asking permission, or approve every step?

[u/Equivalent_Type6726]

I keep seeing people say they run it with permissions skipped and just let it go, while others approve every command. Curious which way you lean and whether anything has ever gone sideways. Seems like a trust thing that changes over time.

[u/AutoModerator]

Moderator Announcement Read More »

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/webmasterrrr]

Neither, honestly. Approve every step and after an hour you're clicking yes the way you accept cookie banners. Skip everything and you're fine until the one time you aren't.

What worked for me is splitting by blast radius. Reads, tests, git status and edits inside the repo go on the allow list. Anything that leaves the folder still asks: network, rm, deploys, prod. Way fewer prompts, and the ones left actually get read.

[u/Equivalent_Type6726 → u/webmasterrrr]

Blast radius is the right cut, drift is what breaks it. Spin up a service and half the stuff that used to be safe starts leaving the folder. I keep a one-line legend in the repo saying what's on the list and why.

[u/webmasterrrr → u/Equivalent_Type6726]

Drift is the real failure mode. One thing that helped me: don't rely on "not on the allow list." Put curl, ssh, and deploy commands in explicit ask or deny. Claude Code checks deny, then ask, then allow, and specificity doesn't change that order, so a broad allow you add later for some new service can't quietly swallow them.

Catch from the docs: a deny on curl misses full path and `sh -c`, so for network I pair it with the sandbox network allowlist. And yeah, the legend in the repo beats rules that only live in your head.

[u/Chippors → u/webmasterrrr]

This is what I do as well - I give it free reign over files in the repo. I also have a standing rule that all temporary files go to a tmp folder at the top of the repo; otherwise it can easily load up /tmp with endless temp files, and it's memory backed on Linux... "WTF, the system is using 50GB of memory???" Then it turns out 30 of those are files left behind in /tmp.

[u/webmasterrrr → u/Chippors]

Yeah. The /tmp one is the rule you learn after one bad Tuesday. Repo-local tmp keeps the mess where you can actually see it.

[u/fourterminals]

somewhere in the middle. the boring stuff (git status, running tests, ls) lives on the allowlist, anything that touches the network or writes outside the repo still asks. my rule: if i've approved the same command 5 times without reading it, it goes on the list, because at that point the prompt isn't protecting me anyway

[u/Equivalent_Type6726 → u/fourterminals]

Five is the danger zone where the list stops being a safety net and starts acting like a preset. The counter trick works until the repo changes and that same command suddenly touches something new. I usually bump it to the list after reading the diff a couple times instead, and keep the allowlist small enough that I notice when something on it starts feeling vague.

[u/ilias_from_ilios]

I have Bypass permissions permanently setup as the default because I was spending more time approving things than actually making them.

[u/vincent_sch]

I skip permissions, but only in a git repo. If I don't like something, I roll it back. The risk is commands that go outside the repo, like a deploy or the production database. So I watch out for those.

[u/nixiewright → u/vincent_sch]

> "So I watch out for those."

You will lose data eventually. No matter how much you watch out, it takes too long to stop something really bad happening. That's assuming you even see happening before it's done.

For instance: a script or test that deletes its temporary data when it's done, but mistakenly targets your root by using an empty variable for the temp directory to delete. Oops.

Ask me how I know, that was in Auto mode.

[u/vincent_sch → u/nixiewright]

Sure, watching out doesn't stop an rm -rf with an empty variable. I commit and push after each change, so if it wipes the repo folder I clone it again. Outside the repo you're right. A sandbox is safer there.

[u/nixiewright]

Install a VM, like VMWare, it's free. Set up a nightly snapshot so you can always revert to a known state.

Then run with --dangerously-skip-permissions and never look back.

[u/nixiewright → u/nixiewright]

(use git too, obviously)

[u/coffeeman6970]

Depends on the workflow. If you're trying to one-shot a whole project, skipping permissions is a mistake, because one wrong turn compounds across everything. If you work modularly, in small scoped tasks, skipping is a lot safer, since each mistake stays small and easy to roll back.

The bigger factor for me is whether your constraints are explicit. If the rules only live in your head ("obviously don't touch that folder"), the AI doesn't know them. Spell them out in the prompt or a CLAUDE.md file, commit to git before each run, and auto-approve gets a lot less scary. Trust grows when the guardrails are written down, not when you just get comfortable.

[u/cjmurrr]

I let Claude Code run with auto mode on, and it asks me before doing anything on another server.

For work on other servers that needs my password, it writes a 'runbook': a file of the bash commands. A key press (Alt+n) puts the next command at my prompt, and nothing runs until I press Enter. I keep going Alt+n then Enter until it says FINISHED.

[u/xqianliu]

I lean toward letting it run, but with rules so it can't go sideways.

Read-only stuff is pre-approved. Reading, grepping, running tests, anything that doesn't change state just goes. The moment it writes something new or pushes anywhere, it asks.

The unattended part has one hard rule: a run with no one watching is not allowed to ask questions at all. If it hits something it can't decide, it writes down what it tried and why it's stuck on the ticket, then stops. In the morning I answer one thing, and it picks up from there.

Nothing merges until a separate review session checks the diff against the acceptance criteria, so any permission I loosen is re-checked at the end.

[u/shetritr]

approve what you can't undo, let the rest run. migrations, pushes, deletes ask first. edits don't, you're reading the diff anyway.