A few days after installing Claude in Chrome, I opened an ad network's admin console and the side panel asked for new permissions. There were three buttons. My thumb went straight for the middle one, and then I stopped.
The middle one was "Always allow actions on this site." I wanted it because the prompts were getting tedious. But that console can rewrite my revenue settings, and I realized I hadn't asked myself whether tedium was a good enough reason to hand over that much trust.
Here is what I'd like to pass on first: permissions come in two layers, a mode and a per-site grant, and the second layer is where people (including me) slip. This post checks both against the current help pages and then shows where I ended up drawing lines in my own indie developer workflow. Labels change over time, so treat this as a snapshot from October 2026.
Permissions have two layers
After rereading the official permissions guide, the first thing I did was separate the layers.
| Layer | Where you set it | What it decides |
|---|---|---|
| 1 | Drop-down on the chat input | How much Claude checks with you before acting |
| 2 | Per-site prompt ("New permissions required") | What Claude may do on that site without asking |
They interact in ways that surprise people. A cautious mode doesn't help much on a site you've set to "always allow," and a relaxed mode still stops on sites that require approval. They are two separate dials.
The three modes
The help center currently lists these modes (older names in parentheses):
| Mode | How it behaves | Good for |
|---|---|---|
| Manually approve (formerly "Ask before acting") | Claude pauses before actions. In the classic panel you approve a plan that names the sites and the approach first | Anything involving money, sent messages, or important files |
| Automatically approve | Claude keeps working while a safety review blocks anything it judges unsafe; if blocks keep happening, it falls back to asking | Reading, collecting, researching |
| Skip all approvals (formerly "Act without asking") | No prompts and no automatic safety check | Only when you fully trust every site, file, and connector involved |
In the Cowork side panel, "Automatically approve" is the default, and your choice persists if you switch.
What I noticed is that the gap between the second and third modes isn't the number of prompts. It's whether anyone is watching. The help page is explicit that skipping approvals also removes the automatic check.
My line: can the work be undone?
I choose a mode by asking whether a mistake in that task could be reversed.
- Reversible (reading, gathering, drafting): Automatically approve
- Hard to reverse (changing settings, sending, publishing): Manually approve
- Skip all approvals: I don't use it
I don't avoid the third mode out of caution so much as lack of need. For read-only work the automatic mode is already fast enough.
Reading an ad revenue report and writing down what I notice, or scanning a crash list for patterns, goes to the automatic mode. Just before I actually change a mediation priority, I switch to manual. To avoid forgetting the switch, I now state the nature of the task at the top of the request:
# Before: no boundary on what Claude may do
Look at my AdMob mediation settings and tell me what to improve.
# After: read-only, with changes handled as a separate request
This task is read-only. Open the AdMob console and list the mediation groups
with their priorities and floors. Do not change, save, or publish anything.
If you think a change is needed, describe it in text and wait for my instruction.I write it this way because the mode protects Claude's actions, but the scope of the request is something only my wording can set. With both in place, if one loosens on a tired day, the other still holds.
When I use "always allow"
This is where I hesitated at the start.
The per-site prompt offers "Allow this action," "Always allow actions on this site," and "Decline." The help page calls the first the safest option when using the extension, and says the second should be limited to sites you completely trust.
My test is two questions, and a site needs a "yes" to both:
- Is the site read-only for practical purposes (or are any changes easy to undo)?
- Is it a first-party page where nobody else's text gets mixed in?
The second question needs an explanation. If Claude reads a page that contains text written by third parties, instructions hidden in that text can be picked up. The official safety guide discusses this class of risk. So any site with comment sections, review areas, or open forums doesn't get "always allow" from me, even for reading.
In practice, my "always allow" list is limited to my own published pages and a couple of report screens that are mostly read-only. Consoles where settings can be edited, such as ad or store dashboards, get "Allow this action" every time. It costs me some clicks, but those are exactly the places where I want to pause.
One note: even on an always-allowed site, Claude still asks before downloading files, entering sensitive information, or granting authorizations. That's documented behavior, and "always allow" doesn't mean "allow everything." But actions outside those three, such as clicking a button that saves a setting, can proceed without asking.
A monthly check-in, nothing more
The opening scene has a sequel. That night I picked "Allow this action," but on another day I gave in to convenience and added "always allow" to a different site, then forgot about it for weeks.
I found it when I opened the settings. From the extension icon, open the three-dot menu at the top right of the side panel, choose "Extension settings," and the Permissions page lists "Your approved sites." You can revoke entries there and view your permission history.
The slip wasn't the setting itself. It was running on the assumption that I would remember what I'd granted. Now I open that list once at the start of each month, remove anything I don't recognize and anything where changes can be made, and I've never missed what I removed. It takes a few minutes.
Lines that don't move
Whatever mode you pick, some things remain off the table: purchases and financial transactions, creating accounts, handling card or ID data, permanent deletions such as emptying trash or deleting email, and following instructions found inside emails or web content.
That's reassuring, but I don't read it as permission to leave the room. The help page itself says no defense is perfect. For work involving money, messages sent in my name, or important files, I stay at the desk.
Tonight, open "Your approved sites" in the extension settings and look at the list. If there's a site you don't recognize, or one where settings can be changed, revoking it takes one click and puts you back on "Allow this action." That's where I started, too.