Priya has a key to the salon. The window cleaner does not.
Nobody wrote a policy about that. There was no meeting. The rule is obvious the second you say it out loud: Priya opens up on Tuesdays, cannot do her job without one, and you are comfortable knowing she is in the building alone at 6am.
The window cleaner comes once a month, does 20 minutes of work in plain sight, and leaves. He gets let in, watched, and let out.
Same building, two arrangements, and nobody agonised over either.
The direct answer on AI computer control safety. Claude Code has six permission modes. Start on default, which asks you before every file edit and every command. Move to acceptEdits after a week if the prompts are slowing you down and your files are backed up somewhere else. plan lets it think out loud without touching your files. auto suits long, low-stakes jobs and does not replace reading anything that sends, charges, or deletes. dontAsk is built for machines that run unattended. bypassPermissions turns the prompts off, and it does not belong on the computer your client list lives on.
This post assumes you have read what Claude Code actually is and got it installed. Steph owns that salon, a two-chair place in Sydney's Inner West, and Priya is one of her two groomers. They are a worked example we follow through this series rather than a real client's books.
What a permission mode is, and why it is the only setting that matters here
A permission mode is the setting that decides what the tool may do on your computer without asking you first. The useful part is not the definition though. It is the shape of the risk underneath it.
Actions come in three categories, not one. Reading a file is cheap and changes nothing. Editing or deleting a file is recoverable if there is a backup or a version history behind it, and Anthropic's documentation says as much: changes are reversible through git or through file checkpoints you can rewind to.
The third category has no undo. Anything with an effect outside your computer cannot be checkpointed. A message that sent. A card that charged. A page that published. Anthropic says these need reviewing carefully before they run. There is nothing to rewind to.
So a permission mode is not a measure of how much you trust the model. It is a decision about which of those categories needs your eyes. Priya has a key because you thought about what she can do with it, not because you like her.
One practical note. Shift and Tab together cycles the first three modes; the other three are set through startup flags or settings files. The riskier options sit deliberately further from your fingers, which is worth respecting rather than working around.
The six permission modes, by name
This is the only post in the series that names them. Everything below is from Anthropic's permission-modes documentation, all six modes, including the one we are going to tell you never to use. A safety post that hides the dangerous option is not a safety post, and you would find it on a forum within a fortnight anyway, described by somebody with no stake in your business.
default, the one to start on
Claude asks you before any file edit and before any shell command. It reads without prompting, so it can look at your files and tell you what is in them, but nothing changes and nothing runs until you say yes.
Anthropic's guidance for this mode is two things: getting started, and sensitive work. Those are not the same recommendation. The first is temporary. The second never expires, which is why you will come back here on purpose for the rest of your working life.
acceptEdits, the one to move to
Claude edits files without asking, and runs a specific set of common filesystem commands without asking: making folders, creating files, moving, copying, deleting, and text substitution. Anything outside that set still comes to you as a prompt.
Read that list again, because one word in it gets skimmed past. Deleting is on it. In acceptEdits a file can be gone without a prompt, which is fine with a backup elsewhere and genuinely painful without one. Anthropic frames the mode as suited to iterating on work you are actively reviewing, and the word doing the work is reviewing.
plan, for when you want it to think out loud
Claude explores and proposes changes without editing your source files. It reads files and runs read-only commands without prompting. Other commands are either evaluated by the auto-mode classifier, where that is available, or brought to you as a question.
Anthropic recommends it for understanding something before you change it. It is the closest thing here to walking the window cleaner around the building first.
auto, the one you will actually be tempted by
In auto, Claude evaluates every action with background safety checks and runs the approved ones without interrupting you. A classifier model reviews each action and blocks things that escalate beyond what you asked for, that target infrastructure it does not recognise, or that look driven by hostile content. Anthropic recommends it for long tasks and for reducing prompt fatigue, and it is available only on the paid subscription plans, and only on Opus 4.6 or later, Sonnet 4.6 or later, or Fable 5.
Now the part that matters, in Anthropic's framing rather than ours. Auto mode reduces permission prompts but does not guarantee safety. The background classifier checks are there to block dangerous actions, and the mode remains advisable for work where you trust the general direction, rather than as a replacement for reviewing sensitive operations.
Which of Steph's jobs is that? Sorting a folder of unnamed phone photos into dated folders is a good fit: long, repetitive, and nothing leaves the building. The shoebox problem is exactly the tedium prompt fatigue was invented to describe.
Anything that sends a message, charges a card, deletes an original, or publishes to a page is not a fit, in any mode, ever. That line does not move because the job got long.
dontAsk, built for machines that run unattended
Claude auto-denies every tool call except the ones matching permission rules you have written in advance, plus read-only commands. It never waits for input, because there is nobody sitting there to give it.
Anthropic's stated use is automated pipelines and restricted environments where you define exactly what is allowed up front. It is stricter than default in one sense and looser in another: nothing unexpected gets through, and nothing gets a human glance either. On the laptop in front of you, there is no reason for it.
bypassPermissions, named here and refused here
This mode disables permission prompts and safety checks, and every tool call executes immediately. Two narrow exceptions survive: a removal aimed at your filesystem root or your home directory still prompts, and so does an explicit rule set by an organisation's policy.
That is the entire extent of the protection. Everything else runs.
Anthropic scopes it to isolated containers, virtual machines, and dev containers with no internet access. Translated into something a salon owner can act on: it is for a sealed machine that holds nothing and can reach nothing. It is not for the computer with your client list on it. Not for a job you feel confident about, and not once you have got used to how the tool behaves.
There is no paragraph in this series that ends with you turning it on, and this is the post that would have written it.
What we recommend, plainly
default for a first week. acceptEdits after that, and only once your files are backed up somewhere that is not the same machine.
And here is the part most guides will not tell you, because it does not sound like progress. A reader who never leaves default has lost nothing except keystrokes. Every job in this level works in it. You spend a few seconds per prompt, and what you buy is the habit of reading what it proposed before it happened, which is the actual skill.
If the prompts wear on you for one repeated command, there is a middle path better than widening everything: you can allow named commands permanently in a settings file, so it stops asking for those and keeps asking for the rest. Widen the one door you meant to widen.
The other half of the title: what never to allow
Two of these lines come straight from the never list, quoted without changing a word.
And never let it:
Those two are the spine of this post. Around them sit three more, specific to a tool with access to your machine.
Anything that sends, charges, deletes, or posts stays a manual action. Not because the tool is bad at it, but because those four verbs have no undo, and every mode above is a decision about reversible things. Draft the message and read it. Prepare the refund and press the button yourself.
Nothing on a work-managed device. If the laptop belongs to an employer, a franchisor, or a shared reception desk, the rules on it are not yours to change, and learning that afterwards lands on you. Use your own machine.
Nothing in a folder you have not looked inside. This is the one that catches people, and it is what the next two sections are about.
Prompt injection, in plain English
This is the risk nobody has an intuition for, because nothing else in business works this way.
If it reads a file, it can be influenced by what is written in that file.
Make it concrete. Steph downloads a wholesale price list from a supplier, drops the PDF in her working folder, and asks the tool to pull the new product prices across. Somewhere in that document, in a footer nobody reads, is a sentence addressed not to her but to whatever software opens the file: instructions to ignore what it was told and do something else with the contents of the folder.
The tool is reading that file because she asked it to, and it has no reliable way to tell which sentences are the supplier's prices and which are aimed at it. Anthropic lists this plainly among the risks: a file containing malicious instructions may get followed.
The defence is not cleverness, it is scope. Only put documents in the folder that you have opened and looked at, keep the mode at one where anything leaving your computer needs your yes, and treat a document as data rather than a colleague. The same caution applies to outside tool servers: Anthropic's own list of risks says an untrusted one could execute commands on your machine. The ones you have not vetted do not go on the business laptop.
The hygiene that makes any of this survivable
Three habits, and they matter more than the mode you pick.
Work in one folder, and make it a copy. A new folder, made for the job, holding copies of the files the job needs. Not your desktop. Not the folder that has everything in it. Then a backup that is not on that machine at all, because acceptEdits deletes without asking. Between them, the worst version of a bad afternoon is a wasted afternoon.
Keep the file with the bank details out of it. Also the one with logins, the exported client list, and anything carrying a card number. Anthropic's limitations documentation says secrets sitting in readable files get read into the context and can leak from there, so a credential in that folder is a credential the tool has seen. The never-paste list applies to a folder exactly as it does to a chat window, because a folder it can read is a thing you have pasted.
Ask the question the regulator asks. OAIC's checklist for choosing an AI product includes exactly this: will it be integrated into your systems, and will it have access to your documents. OAIC separately recommends, as best practice, that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because once it is in it is very difficult to track and potentially impossible to remove. That is a recommendation rather than a prohibition, and it is the right thing to hold in mind while you decide what goes in the folder.
The safety net has holes, and saying so is the point
Every protection above is a net, not a fence. The classifier in auto mode is a model making judgements, so it can be wrong in both directions. The circuit breakers in bypassPermissions cover two specific catastrophes and nothing else. Checkpoints rewind your files and cannot rewind an email.
The tool also has blind spots no permission setting touches, and Anthropic's documentation is direct about them: it cannot see the side effects of a command until it has run it, it cannot see your business context beyond what is in front of it, and confident-sounding wrong answers remain possible. That last one has a post of its own on why it gets things wrong, and it is why the ten-second check never stops being your job.
None of that is an argument against using it. It is an argument for keeping the irreversible things on your side of the door, the same argument you already made about the window cleaner.
What this actually reclaims for you
Steph gives two evenings a week to admin, two hours each. Work in default for a week and the cost is a few seconds per prompt against those four hours.
The honest second half is a risk you did not take. A client list read into a place you cannot delete it from, a message that sent before you saw it, an original photo gone with no copy behind it: none of those show up as an hour reclaimed on a spreadsheet, and any one of them costs more than the whole exercise was going to return. Avoiding them is a real result, and worth counting as one.
Next in the ladder, and worth reading before you point this at pet records: where AI must never go in pet care, by Annika, who runs the business we started. Then the three real jobs to give it in your first hour.