Choose a permission mode changedpermission-modes
Nearest release: v2.1.285, published 10 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 30 Sep 2026 04:31 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 30 Sep 2026 04:37 UTC.
Upstream edited
Recorded here
Lines+2added
Lines−6removed
From line
346
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits91to this page, all time
The whole hunk
from line 346, old and new numbered
/
from line 346
346346* `git commit --amend` when the commit at HEAD was not created in this session
347347* From v2.1.198, `git commit --amend` when the commit at HEAD has already been pushed. A message-only reword is not blocked: `--amend -m` with nothing newly staged, on a commit that Claude created during this session
348348* `terraform destroy`, `pulumi destroy`, `cdk destroy`, or `terragrunt destroy`, and applying a plan that destroys resources
349
350Claude Code v2.1.195 and later block more categories by default. Several depend on [environment](/docs/en/auto-mode-config#define-trusted-infrastructure) entries, such as sensitive remote targets and protected IaC scopes, that you can narrow to concrete names.
351
352349* Writing to a secret manager, or changing DNS records or TLS certificates
353350* Merging a pull request no human has approved, approving Claude's own pull request, or disabling CI checks
354351* Posting a comment that is itself a command to automation, such as `atlantis apply` or a bot's `/deploy` or `/merge`
from line 362
365362* Launching an autonomous agent loop that runs without human approval or a sandbox, such as one started with `--dangerously-skip-permissions` or `--no-sandbox`. As of v2.1.198 this also covers running a third-party agent or eval harness with isolation and per-action approval disabled, such as a runner started with `--yes-always`
366363* [Claude in Chrome](/docs/en/chrome) browser actions that could send page content, cookies, or credentials off-origin
367364
365Several of these categories depend on [environment](/docs/en/auto-mode-config#define-trusted-infrastructure) entries, such as sensitive remote targets and protected IaC scopes, that you can narrow to concrete names.
366
368367Claude Code v2.1.198 and later also block these by default:
369368
370369* Deleting files in `/tmp`, `$TMPDIR`, or another shared scratch or cache directory by wildcard, glob, or age filter rather than by a specific named path
from line 410
411410* Reading `.env` and sending credentials to their matching API
412411* Read-only HTTP requests
413412* Pushing to any branch of the repository you're working in, including the default branch. A non-default branch whose name marks it as a deploy or publication target, such as `production` or `gh-pages`, isn't covered: the classifier judges a push there on its own terms. The push's content is still checked against the other rules, [`permissions.deny` rules](/docs/en/permissions#manage-permissions) can still block push commands [as written](/docs/en/permissions#bash-rule-limits) in every mode, and the remote's own branch protection still applies. Before v2.1.211, only pushes to the branch you started on, branches Claude created, and routine pushes to the default branch were allowed by default, and before v2.1.203 any direct push to the default branch was blocked
414
415Claude Code v2.1.195 and later also allow these by default:
416
417413* Deleting the exact jobs Claude created earlier in the same session
418414* Reading, reviewing, or writing security-related code, configs, and threat models as part of your task
419415* Messages between agents working together in the same multi-agent session
No line in this hunk matches that.