Claude Code, Codex CLI, and Gemini CLI. Terminal-based AI coding agents are evolving rapidly.

By default, these tools ask for user approval before every file write and command execution. This is safe, but for large-scale refactoring or repetitive tasks, approval prompts become a bottleneck.

Each tool provides modes to relax permissions and let the agent run autonomously. This post compares the permission models of all three CLI agents and explains how to configure full autonomy, along with the caveats you should know.

Cheat Sheet: Copy-Paste Full Permission Commands

Claude Code

# Full permissions (for isolated environments)
claude --dangerously-skip-permissions
 
# Autonomous with AI safety review (Team/Enterprise/API plan required)
claude --permission-mode auto

Codex CLI

# Autonomous within workspace (recommended)
codex --full-auto
 
# No sandbox, no approvals
codex --yolo

Gemini CLI

# Auto-approve all tool calls
gemini --approval-mode yolo
 
# Auto-approve all tool calls with sandbox
gemini --approval-mode yolo --sandbox

Details and risks for each command are covered in the sections below.

Claude Code Permission Modes

Claude Code offers six permission modes.

You can cycle through modes mid-session with Shift+Tab.

Auto Mode: AI Watching AI

auto mode is unique to Claude Code. It runs without user approval prompts while a separate classifier model reviews each action in the background.

claude --permission-mode auto

The classifier blocks actions in these cases:

• Escalation beyond the scope of the original request
• Access to unrecognized infrastructure
• Operations driven by malicious content

If actions are blocked 3 times consecutively or 20 times total, auto mode pauses and falls back to normal approval prompts.

auto mode has requirements: it needs a Team, Enterprise, or API plan, works only via the Anthropic API, and requires Sonnet 4.6 or Opus 4.6 models.

bypassPermissions Mode: Everything Goes

claude --dangerously-skip-permissions

This skips all permission checks. Only writes to protected paths (.git, .claude) still prompt.

As the dangerously in the flag name suggests, there is no protection against prompt injection or unintended actions. This mode is intended for use in isolated environments like Docker containers or VMs.

Administrators can disable this mode organization-wide by setting permissions.disableBypassPermissionsMode to "disable" in managed settings.

Codex CLI Permission Model

Codex CLI controls permissions along two axes: “approval policy” and “sandbox mode.”

Approval Policies

Sandbox Modes

Shortcut Flags

In practice, two shortcut flags cover most use cases.

# Autonomous within the workspace (recommended)
codex --full-auto
 
# No sandbox, no approvals (not recommended)
codex --yolo

--full-auto combines the workspace-write sandbox with the on-request approval policy. The agent moves freely within your workspace but is restricted from external access.

--yolo (officially --dangerously-bypass-approvals-and-sandbox) removes all restrictions.

Gemini CLI Permission Model

Gemini CLI offers four approval modes.

# Launch with full permissions
gemini --approval-mode yolo

Gemini CLI’s yolo mode has an intentional constraint: it cannot be set as a default in settings.json and must be explicitly specified via the command-line flag every time. This design prevents accidental full-permission sessions.

Administrators can set security.disableYoloMode: true to prevent yolo mode from activating even when the flag is passed.

Combining with Sandbox

Gemini CLI has a separate sandboxing feature that uses macOS seatbelt profiles.

# Launch with sandbox enabled
gemini --sandbox

Six profiles are available, ranging from permissive-open to strict-proxied. Combining yolo mode with sandboxing gives you “no approval prompts, but sandboxed execution,” a useful middle ground.

Three-Way Comparison

All three tools share a common design choice: the flag names for full-permission modes carry explicit warnings. dangerously, yolo are not just names but signals to developers that they are opting out of safety guardrails.

Claude Code is the only tool that offers a middle ground with auto mode, where a separate AI model reviews actions in the background while running without user prompts.

When to Use Full Permissions

Recommended scenarios

• Isolated CI/CD environments: Code generation and test execution inside Docker containers or VMs
• Disposable development environments: Prototyping in GitHub Codespaces
• Large-scale refactoring: Mechanical changes across hundreds of files (import path updates, API migrations)
• Repetitive tasks: Test generation, documentation updates, boilerplate creation

Scenarios to avoid

• Machines with direct production access: Risk of unintended infrastructure changes or database operations
• Working with untrusted codebases: High risk of prompt injection
• Repositories containing secrets: Running without a sandbox in environments with credentials is dangerous

Practical configurations

Here are the configurations I use day to day.

# Daily development: scoped autonomy
claude --permission-mode acceptEdits
 
# Large refactoring: auto mode (with AI safety review)
claude --permission-mode auto
 
# CI/CD pipeline (inside Docker): full permissions
claude --dangerously-skip-permissions

For Codex CLI:

# Daily development
codex --full-auto
 
# CI/CD pipeline (inside Docker)
codex --yolo

The key principle: scoped autonomy for local daily work, full autonomy only in isolated environments.

Conclusion

Claude Code, Codex CLI, and Gemini CLI each take a different approach to permission model design.

• Claude Code: Six modes with a unique AI safety review in auto mode
• Codex CLI: Two-axis control (approval policy + sandbox) with --full-auto as the practical choice
• Gemini CLI: Simple four-mode system with yolo mode intentionally restricted to CLI-flag-only to prevent misuse

Full permission modes are powerful, but they are designed for isolated environments. For everyday development, the “scoped autonomy” modes each tool provides (Claude Code’s auto / acceptEdits, Codex’s --full-auto, Gemini’s auto_edit) are the practical choice.

That’s all from someone comparing AI coding CLI permission settings. From the gemba.

References

• Claude Code: Permission modes
• Codex CLI: Agent approvals & security
• Gemini CLI: Configuration reference
• Gemini CLI: Sandbox