Six permission modes decide what runs without asking. The evaluation order they sit inside, what each one actually approves, how auto mode's classifier makes its call, and the paths no mode will ever wave through.

CLI flags, slash commands and in-prompt sigils are three separate input channels, distinguished by when they are parsed and whether they reach the model at all. The mental model, the handful you actually use, and where the full reference lives.

A language model has no filesystem, no shell and no network. Claude Code is the process that supplies them and drives the model in a loop. The execution model, the tools, and the one rule the permission system grows from.