Chapter 1 established the asymmetry: read-only tools run without asking, state-changing tools do not. A permission mode sets where that line falls for a session.

The mode is one gate among several, and the order matters more than any individual mode does.

flowchart TB
    A([Tool call]) --> D{deny rule?}
    D -->|match| X([Blocked])
    D -->|no| K{ask rule?}
    K -->|match| P([Prompt])
    K -->|no| S{protected or
critical path?}
    S -->|yes| M2[Mode-specific
handling]
    S -->|no| M{Permission mode}
    M -->|default / acceptEdits| P
    M -->|dontAsk| X
    M -->|bypassPermissions| R([Runs])
    M -->|auto| C{Classifier}
    C -->|approves| R
    C -->|blocks| X

Two consequences fall out of that ordering, and both are load-bearing for the rest of this chapter: