How to stop Claude Code and Codex asking for permission in 2026: 8 ways compared

Disclosure: Enjoy is our product, and it shows every agent’s permission requests in its conversations. We checked each way below against Anthropic’s, OpenAI’s and Docker’s own documentation on November 11, 2026, and we say where another way is the better pick, including the free ones that need nothing but Claude Code or Codex.

The ways to stop the prompts, compared

Claude Code and Codex ask before they act because they run commands and change files on your computer. Approving the same test command all day protects nothing, though, so both now ship several ways to ask less. They differ in what stands between the agent and your files once the questions stop: a list you wrote, a second model, the operating system, a container, or nothing at all.

Way	Best for	Price, checked November 11, 2026	In Claude Code	In Codex
Allow rules	The same few commands, asked again and again	Free, built in	“Yes, and don’t ask again,” /permissions and permissions.allow	The allow list in the terminal, and prefix_rule files
Accept edits in the project	Reviewing the diff afterwards	Free, built in	Accept edits mode	The Auto preset, which Codex recommends in a Git folder
A second model reviews	Long tasks you’d rather not watch	Free, built in; it can add to usage	Auto mode, the starting mode from 2.1.283	Approve for me, or approvals_reviewer = "auto_review"
The sandbox	Commands that stay inside your project	Free, built in	/sandbox with auto-allow, on macOS, Linux and WSL2	On by default; --ask-for-approval never keeps it
A hook that answers	Decisions a pattern can’t express	Free, built in	PermissionRequest and PreToolUse hooks	PermissionRequest hooks
Skip every check, in a container or VM	Unattended runs you can afford to lose	Free; Docker Sandboxes’ local sandboxes are free too	--dangerously-skip-permissions	--dangerously-bypass-approvals-and-sandbox, or --yolo
Answer from your phone	Keeping every prompt, away from your desk	Claude Pro and up; the ChatGPT app, subject to rollout	Remote Control and the Claude app	The ChatGPT mobile app, with a connected Mac or Windows PC
Enjoy	Several agents’ requests in one place, answered from any device	A monthly subscription, free for 7 days, with your phone and one computer (pricing)	Its six modes in one picker	Its four modes in the same picker

Every way but Enjoy is built into Claude Code or Codex, or comes with Docker’s free command-line tool, so there’s nothing new to buy. Remote Control needs a Claude plan, not an API key, and Docker charges only for its cloud sandboxes.

Before you start: find out why it’s asking

• Update first. “With Claude Code v2.1.283 or later, auto mode is the built-in starting permission mode for interactive terminal and VS Code sessions on every plan and provider,” say Anthropic’s permission modes docs. A saved default still wins: “If your ~/.claude/settings.json sets a defaultMode other than auto and no other settings file sets one, your sessions keep starting in that mode.”
• Check the mode you’re in. Claude Code’s status bar names it, such as ⏸ manual mode on or ⏵⏵ auto mode on, and Shift+Tab cycles through them. In Codex, /permissions opens the picker in the CLI, and the desktop app and IDE extension have “the permissions control beneath the composer.”
• Rules outrank each other. In Claude Code, “Rules are evaluated in order: deny, then ask, then allow,” and “a matching ask rule prompts even when a more specific allow rule also matches the same call,” per its permissions docs.
• Chained commands are checked piece by piece. Claude Code “is aware of shell operators, so a rule like Bash(safe-cmd *) won’t give it permission to run the command safe-cmd && other-cmd,” and “Every subcommand must be allowed for a compound command to run without a prompt.”
• Codex asks at the edge of its sandbox. In its Auto preset, “Codex asks for approval to edit files outside the workspace or to run commands that require network access,” per its approvals docs. In a folder that isn’t under version control it recommends read-only, and it “may also start in read-only until you explicitly trust the working directory.”
• Scripts don’t ask, they refuse. From Claude Code 2.1.302, claude -p and Agent SDK runs with no mode set “start in Manual mode,” and “Calls needing approval are denied unless you approve them with an allow rule, hook, canUseTool callback, or --permission-prompt-tool.”
• A few things ask in every mode. “Claude Code doesn’t auto-approve the following in any mode, including bypassPermissions,” and the list includes your own ask rules, tools that need your input, and rm on critical paths such as your home folder. Our memo covers the variable that lifts the last one in bypass mode.

Allow the commands you trust

Best for: the same few commands asked again and again, such as your tests and your linter.

In Claude Code, the prompt offers it. Choose “Yes, and don’t ask again” on a Bash command and the approval lasts “Permanently per repository and command,” per the permissions docs: Claude Code “saves the rule to .claude/settings.local.json at the root of the git repository.” /permissions lists every rule “and the settings.json file each rule comes from,” and you can write rules by hand in a settings file:

{
  "permissions": {
    "allow": ["Bash(npm run lint)", "Bash(npm run test *)"]
  }
}

In Codex, “When you add a command to the allow list in the TUI, Codex writes to the user layer at ~/.codex/rules/default.rules so future runs can skip the prompt,” per its rules docs. A rule is a prefix_rule with a pattern, such as ["gh", "pr", "view"], and a decision. The decision allow means “Run the command outside the sandbox without prompting.”

Price: free, built in.

Watch for: a rule is only as narrow as its pattern. Anthropic warns that runners such as npx and docker exec “execute their arguments as a command,” so “a rule like Bash(devbox run *) matches whatever comes after run, including devbox run rm -rf ..” A saved rule holds the command it approves, and our memo covers Apiiro’s report of secrets in public copies of that file. OpenAI says “Rules are experimental and may change,” and of the rules Codex proposes, “Review the suggested prefix carefully before accepting it.”

Accept edits inside the project

Best for: people who review the diff afterwards instead of each change as it’s made.

Claude Code’s accept edits mode “lets Claude create and edit files in your working directory without prompting,” and it also approves “common filesystem Bash commands: mkdir, touch, rm, rmdir, mv, cp, and sed.” Press Shift+Tab once from Manual mode, or start with claude --permission-mode acceptEdits. Anthropic’s advice: “Use acceptEdits when you want to review changes in your editor or via git diff after the fact rather than approving each edit inline.”

Codex starts closer to this. In its Auto preset, --sandbox workspace-write --ask-for-approval on-request, “Codex can read files, make edits, and run commands in the working directory automatically.” For the desktop app and IDE extension, OpenAI’s permission modes page says “For most work, start with Ask for approval. It lets ChatGPT work within the current workspace and pauses before reaching beyond that boundary.”

Price: free, built in.

Watch for: in Claude Code, accept edits still asks about “All other Bash commands except the built-in read-only set,” so a test run stops for you unless a rule allows it. In Codex the workspace is the limit, and some folders inside it stay read-only: .git, .agents, .codex and .aws are each “protected as read-only” in the default sandbox.

Let a second model review: auto mode and Approve for me

Best for: long tasks you’d rather not watch, on your own computer.

In Claude Code, “Auto mode lets Claude execute without routine permission prompts. A separate classifier model reviews actions before they run, blocking anything that escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read.” Its default block list includes “Downloading and executing code, like curl | bash,” “Production deploys and migrations” and “Force push.” Where it isn’t already your starting mode, start with claude --permission-mode auto, press Shift+Tab until the status bar shows it, or choose Auto in VS Code or the desktop app.

Codex’s Auto-review “sends eligible approval requests to a separate reviewer agent.” In the desktop app, “choose Approve for me from the permissions control below the composer.” For the CLI, set both lines in config.toml:

approval_policy = "on-request"
approvals_reviewer = "auto_review"

It doesn’t widen what Codex can reach: “Approve for me keeps the same workspace boundary as Ask for approval; it sends requests to cross that boundary to automatic review.” The reviewer “checks for data exfiltration, credential probing, persistent security weakening, and destructive actions.”

Price: free, built in, though the reviewing can use usage of its own. OpenAI says “Auto-review uses extra model calls, so it can add to Codex usage.” Anthropic says “On Enterprise plans and on accounts that use the Claude API,” among others, “classifier calls count toward your token usage.”

Watch for: Anthropic’s own warning is “Auto mode reduces permission prompts but does not guarantee safety. Use it for tasks where you trust the general direction, not as a replacement for review on sensitive operations.” It needs a supported model, an administrator can turn it off, and “if the classifier blocks an action 3 times in a row or 20 times total, auto mode pauses and Claude Code resumes prompting.” Entering it also drops broad allow rules, such as “Blanket Bash(*),” until you leave. In Codex, a denied action means the agent “is instructed to find a materially safer path or stop and ask the user,” so the prompts don’t vanish entirely. Our memo on auto mode in Claude’s apps covers what it approves and how to switch back.

Turn on the sandbox

Best for: commands that only need your project, approved by the operating system instead of by you.

Claude Code’s Bash sandbox “is a boundary that the operating system enforces around the shell commands Claude runs on your machine,” and “Because the operating system applies the limits while a command runs, Claude Code can run sandboxed commands without asking you to approve each one.” Run /sandbox, and “On the Mode tab, select auto-allow or regular permissions.” Anthropic lists the pairing for anyone who wants to “Iterate locally with fewer prompts, without a classifier”: “Manual mode plus the Bash sandbox in auto-allow mode.”

Codex is sandboxed from the start: “The default permissions mode applies sandboxing automatically,” says its sandbox page, and “The sandbox reduces approval fatigue.” To stop the prompts that remain without leaving it, “You can disable approval prompts with --ask-for-approval never or -a never,” which “works with all --sandbox modes,” so “Codex makes a best effort within the constraints you set.” If every prompt is about the network, that’s a setting: in workspace-write mode, network access stays “turned off unless you enable it in your configuration.”

[sandbox_workspace_write]
network_access = true

Price: free, built in.

Watch for: Claude Code’s sandbox “runs on macOS, Linux, and WSL2. On native Windows, Claude Code runs commands unsandboxed,” and on Linux it “relies on bubblewrap and socat.” It “covers shell commands only. Claude’s file tools, MCP servers, and hooks run outside it.” A command that fails inside can leave: “Claude analyzes the failure and may retry the command with the dangerouslyDisableSandbox parameter,” and in Manual and accept edits modes the retry asks first, in a prompt titled “Bash command (unsandboxed).” Codex needs bubblewrap on Linux too, and inside a Docker container “the sandbox may not work if the host or container configuration blocks” what it needs. Codex also “runs with network access turned off” by default, so turning it on is a wider choice than one line suggests.

A hook that answers for you

Best for: decisions a pattern can’t express, made by a script you write.

Both agents run a hook at the moment they would ask. In Claude Code, “PermissionRequest hooks run only when Claude Code is about to ask you for permission,” and one can “allow or deny a permission request on behalf of the user,” per its hooks docs. In Codex, “PermissionRequest runs when Codex is about to ask for approval, such as a shell escalation or managed-network approval. It can allow the request, deny the request, or decline to decide and let the normal approval prompt continue,” per its own. Both read the same answer from the script:

{
  "hookSpecificOutput": {
    "hookEventName": "PermissionRequest",
    "decision": { "behavior": "allow" }
  }
}

Price: free, built in.

Watch for: a hook is a program on your computer that says yes for you, so its mistakes are yours. In Claude Code, “a hook returning "allow" doesn’t override a matching deny rule,” and a PreToolUse hook can’t approve an rm on a critical path. In Codex, “Non-managed hooks must be reviewed and trusted before they run,” and “If multiple matching hooks return decisions, any deny wins.”

Skip every check, in a container or VM

Best for: unattended runs in an environment you can afford to lose.

claude --dangerously-skip-permissions starts Claude Code in bypass permissions mode, which “disables permission prompts and safety checks so tool calls execute immediately.” Codex’s equivalent is --dangerously-bypass-approvals-and-sandbox, “alias: --yolo,” and its effect is “No sandbox; no approvals.” Full access in the desktop app “means using sandbox_mode = "danger-full-access" together with approval_policy = "never".”

Both makers say where it belongs. Anthropic: “Only use this mode in isolated environments like containers, VMs, or dev containers without internet access, where Claude Code cannot damage your host system.” OpenAI: “avoid --dangerously-bypass-approvals-and-sandbox unless you are inside a dedicated sandbox VM.” Two ways to get that isolation:

• A dev container. Claude Code’s dev container “runs Claude Code as a non-root user and confines command execution to the container,” and OpenAI says to “run Codex with Dev Containers and let Docker provide the outer isolation boundary.”
• Docker Sandboxes. Docker Sandboxes “run AI coding agents in isolated environments on your machine or on Docker-managed cloud infrastructure.” By default, sbx run claude ~/my-project runs claude --dangerously-skip-permissions, and its Codex sandbox runs codex --dangerously-bypass-approvals-and-sandbox, each inside a microVM: “The agent has full control inside the VM, including sudo access. The VM boundary prevents the agent from reaching anything on your host except what is explicitly shared.”

Price: free in Claude Code and Codex. Docker says “The sbx CLI and local sandbox compute are free to use, including for commercial work. Cloud compute uses a pay-as-you-go subscription.”

Watch for: a container narrows the damage; it doesn’t remove it. Anthropic warns that “dev containers do not prevent a malicious project from exfiltrating anything accessible inside the container, including the Claude Code credentials stored in ~/.claude,” and OpenAI says the same of Codex’s. On your own computer, bypass mode “offers no protection against prompt injection or unintended actions,” and on Linux and macOS, Claude Code “refuses to start in bypassPermissions mode when running as root or under sudo.” Docker’s local sandboxes need “macOS Sonoma version 14 or later” on “Apple silicon,” Windows 11, or “Ubuntu 24.04 or later” with KVM, and “Sandboxes don’t pick up user-level configuration from your host, such as ~/.claude.”

Answer from your phone

Best for: keeping every prompt, without sitting at your desk to answer it.

The prompts are less of a cost when they find you. Claude Code’s Remote Control “connects claude.ai/code or the Claude app for iOS and Android to a Claude Code session running on your machine.” Run /config and enable “Push when actions required for permission prompts and questions,” and the request waits for you: “Claude Code keeps permission prompts and AskUserQuestion questions open until you answer them.”

For Codex, the ChatGPT mobile app lets you “Follow progress, approve actions, and send instructions from your phone,” says Codex on mobile, on “Cloud or a connected Mac or Windows PC.” Setup starts in the desktop app, under Settings > Connections > Control this Mac or PC.

Price: Remote Control is “available on Pro, Max, Ultra, Team, and Enterprise plans. API keys are not supported.” For Codex on mobile, “Availability depends on rollout and your workspace settings.”

Watch for: the computer still does the work. For Claude Code, “your computer has to stay on and the claude process has to keep running.” For Codex, “If that computer sleeps, loses network access, or closes the app, remote access stops until it’s available again,” and “Mobile setup starts from the app; you can’t set it up from the Codex CLI or IDE extension,” per its remote connections docs. Our guides to Claude Code and Codex from your phone compare the other apps that do this.

Enjoy

Best for: people who run more than one agent and would rather answer its requests, from any device, than turn them off.

Enjoy is a desktop app for Mac, Windows and Linux that runs Claude Code, Codex, Grok Build, Antigravity, Muse Code, and local models through OpenCode, on the plans you already have. It doesn’t replace their permission systems: “The modes come from the companies that make each agent, and the agent itself enforces them.” What it adds:

• One picker for every agent. The Permissions column lists Claude Code’s six modes, Codex’s four and the other agents’ own, with what each allows, and “Enjoy remembers the mode you last sent with each agent in a project.”
• Requests as cards. A request “appears as a card in the conversation, and the agent waits until you decide,” with “the exact command or the files it wants to change.”
• One list of what’s waiting. Inbox gathers conversations from every project and groups the ones waiting on you under Needs you.
• Answers from your phone or a browser. A device you’ve given Full access “can answer approval requests,” in the iPhone app or the web app.
• No quiet widening. “Enjoy never picks a broader mode for you in its place,” and “A conversation that an agent starts can’t have broader permissions than the conversation that started it.”

Price: Enjoy is one monthly subscription, and the first seven days are free, with a card to start. It includes your phone, any browser and one computer; each other computer costs extra each month, and each teammate you invite needs a subscription of their own. See pricing.

Watch for: the modes are the agents’ own, so each is as safe as Anthropic or OpenAI made it, and no safer in Enjoy. In Enjoy, Claude Code starts in Auto and Codex in Approve for me, and Antigravity’s default is Bypass permissions, so check the picker before your first message. Its iPhone app “connects while it’s open and doesn’t send notifications,” so a request waits until you look, where Claude’s app can push one to you. “If Enjoy quits while a request is waiting, the request is recorded as declined when Enjoy opens again.” Your phone and browser reach your computer through Enjoy’s servers, and the computer has to be on and awake, with Enjoy running. Enjoy isn’t open source, it’s a monthly subscription on top of your AI plans once the free week ends, and scheduled workflows run only while your computer is awake with Enjoy open. If you use one agent and sit at the computer it runs on, the free ways above are all you need.

When to keep the prompts

Keep them when a mistake would be expensive. Anthropic’s own table gives Manual mode as best for “Reviewing every action yourself, sensitive work.” For work you only want understood, Claude Code’s plan mode and Codex’s read-only mode change nothing: “If you want to chat or plan without making changes, switch to read-only mode with the /permissions command.”

If the prompts only feel constant, two allow rules usually fix it without widening anything. OpenAI’s advice for each approval is to “choose the narrowest scope that lets the task continue.” And before you loosen a mode, write down what should never run: in Claude Code, “Deny rules block in every mode, including bypassPermissions.”

How we compared

We read Anthropic’s Claude Code documentation on permission modes, permissions, settings, sandboxing, sandbox environments, hooks, dev containers, Remote Control and the desktop app; OpenAI’s Codex documentation on approvals and security, the sandbox, permission modes, Auto-review, rules, hooks, developer commands, mobile and remote connections; and Docker’s Sandboxes documentation, on November 11, 2026. Every one is linked below. We quote each maker’s own words for what a mode allows and where it stops, we leave out what isn’t documented, and we didn’t test Docker Sandboxes ourselves. What we say about Enjoy comes from its help center. Both agents change their permission modes often, so we recheck this guide against its sources at least once a month, and the date at the foot of the page says when we last did.