The Default Permission Mode When You Add -p

The correct answer is "Manual — the same built-in default as an interactive session."

The built-in starting permission mode is Manual on every plan, even in headless runs — Claude Code doesn't quietly switch to something more automation-friendly just because there's no terminal to prompt in. A script that never passes --permission-mode or --allowedTools is relying on Manual mode's small built-in read-only command set plus whatever permissions.allow rules already exist in loaded settings, which is rarely what an unattended job actually wants.

The distractors assume headless mode changes the default on its own: it doesn't switch to acceptEdits just because it's unattended, it doesn't fall back to dontAsk without being told to, and it certainly doesn't skip the permission system via Bypass permissions by default.