freno-dev/marketing/approved/agent-waiting-on-permission/copy.md

Why is my coding agent sitting on a permission prompt?

Status: approved — sponsor fact-check passed 2026-11-05 (FRE-199 fact-check card, verdict: "Approve both — move to approved/"). Not published; a human places it on nook.freno.me from approved/. This page never names a product of ours and never names a competitor. Internal target: second page of the FRE-199 pair, Fri 2026-11-07.

Because it tried to do something its permission settings don't allow, and the default is to wait — indefinitely and quietly — for you. The prompt is not the expensive part; the hour you spent not knowing it was waiting is. The way out is not to approve faster, it's to make the prompts rare and the waiting visible.

The mechanism

Claude Code's permission system decides, per tool call, whether to run, refuse, or stop and ask. In its default mode, it prompts for permission on the first use of each tool. Modes are set with defaultMode in the settings files, and a session's rules come from allow / ask / deny lists evaluated in that order — the first match wins.

You can see the whole rule set at any time with /permissions, which lists every permission rule and the settings file each one came from. Rules can name a specific use — Bash(npm run build) matches exactly that command — or a wildcard, like Bash(git log *).

So the prompt you came back to an hour later is not a malfunction. It is the system working as configured, on a call your rules never covered — and the "waiting" state being invisible is what turned ten seconds of approval into a lost hour.

What to check or do

1. Read the prompt before automating it away. It names the tool and the input. The right response to "it keeps asking" is usually a rule, not a wider mode.
2. Allowlist the undoable, prompt on the irreversible. Reads, tests, and status commands are safe to allow — git is the undo for edits. Anything that reaches another person or another system — network calls, deletes, deploys — is worth keeping on ask. Rule syntax is in the permission docs; /permissions shows what you already have.
3. Consider acceptEdits before anything broader. It auto-accepts file edits and common filesystem commands inside the working directory. That is usually the difference between ten prompts a session and two — without handing over network or delete.
4. Bound the blast radius instead of removing the gate. If you do widen what runs unattended, do it where a mistake is recoverable: a worktree per task, commits pushed early, nothing irreversible in reach. Operators who run agents unattended describe exactly this split — free hand on what git can undo, confirmation on what it can't.
5. Make the wait visible. Claude Code fires a Notification hook when it sends a notification, and a permission prompt is one — the payload carries a notification_type of permission_prompt. A hook on that event, wired to a desktop notification you'd see from another window, turns the silent wait back into a ten-second approval.

One next step: run /permissions today and add allow rules for the three commands you find yourself approving most. The prompts that remain will be the ones that deserve a read.

---

Fact-check table (not part of the page)

Every technical claim above, with its primary source. Claims about Claude Code's behaviour come from its own documentation, re-read 2026-11-05.

#	Claim in the page	Source
1	In default mode Claude Code "prompts for permission on first use of each tool"	Claude Code permissions doc — https://docs.anthropic.com/en/docs/claude-code/permissions (Permission modes table)
2	defaultMode in settings files sets the default mode for new sessions	same permissions doc (Permission modes section)
3	Rules are evaluated deny → ask → allow, first match wins	same permissions doc (Permission rule syntax)
4	/permissions lists all permission rules and the settings.json each comes from	same permissions doc (Manage permissions)
5	Bash(npm run build) matches the exact command; Bash(git log *) wildcard form	same permissions doc (Use specifiers for fine-grained control)
6	acceptEdits "automatically accepts file edits and common filesystem commands such as mkdir, touch, mv, cp for paths in the working directory"	same permissions doc (Permission modes table)
7	A Notification hook fires when Claude Code sends a notification; permission prompts carry notification_type: "permission_prompt" and a message like "Claude needs your permission"	Claude Code hooks reference — https://docs.anthropic.com/en/docs/claude-code/hooks (Notification event)
8	Undo-split practice ("free hand on what git can undo, confirmation on what it can't")	r/ClaudeCode 1xkoz06 (2026-10-31, u/tomm3hshipp thread), commenter's described practice, logged in drafts/listening.md Scan 3 addendum. Described as one operator's approach, not a rule.
9	The 55-minutes-lost framing	r/ClaudeAI 1xhbc71 (2026-10-28): "coming back an hour later to find it's been sitting on a permission prompt for 55 minutes". Used as the problem's shape, not quoted as a person.

Ban compliance: no product of ours named · no competitor named · no superlatives · no benchmark numbers · no invented testimonials · no price · no roadmap dates.