2026.09.26 2026.09.26

Decide Claude Code Permissions and Cost Before You Leave It Running

swiftwand

Before you leave anything running unattended, two questions deserve an answer you have actually checked: who presses approve when nobody is there, and where does the money go. This article answers both by measuring one ordinary turn and then walking each surface.

The bill starts with the preamble, not the rate
Read the rate card as writes and reads, separately
Cache lifetime depends on who is paying
What breaks the cache and what does not
Checking it in your own setup
Fable can put you on metered usage without asking twice
Who presses approve, surface by surface
Seven things not to hand over
What to leave running at the 3D printing bench
The short version
Sources

忍者AdMax

The bill starts with the preamble, not the rate

Here is a single turn from a real session, as Claude Code reported it.

Item	Value
Tokens written to cache with a 1-hour TTL	51,962
Tokens written with a 5-minute TTL	0
Tokens read from cache	15,055
Fresh input that missed the cache	2
Output	385
Estimated cost shown by Claude Code	$0.5368
Elapsed	6,767 ms

Look at the shape. Two tokens of genuinely new input and 385 of output, against nearly 52,000 tokens written to cache. The visible work was a short exchange; the bill was almost entirely the preamble being written down for later.

The arithmetic confirms it. On Claude Opus 5 rates, the 1-hour cache write of 51,962 tokens at $10 per million is $0.5196, the 15,055 cache reads at $0.50 per million are $0.0075, and the 385 output tokens at $25 per million are $0.0096. That totals $0.5368. Ninety-seven percent of the turn was the cache write.

This is why watching input and output rates tells you almost nothing about what a long session costs. The number that matters is how large your fixed preamble is and how often it gets rewritten.

Read the rate card as writes and reads, separately

Per million tokens	Claude Opus 5	Claude Fable 5.1
Input	$5.00	$10.00
Output	$25.00	$50.00
5-minute cache write	$6.25	$12.50
1-hour cache write	$10.00	$20.00
Cache read	$0.50	$0.25

Fable 5.1 is double on everything except reads, where it is half. So the model comparison turns entirely on your read-to-write ratio. A session that writes a huge cache once and reads it a hundred times favours Fable. A session like the one measured above, dominated by a single write, does not.

Cache lifetime depends on who is paying

Request bucket	Claude subscription, within plan usage	Usage credits, API key, or cloud provider
Main conversation, being interactive turns, -p runs, and Agent SDK turns	One hour	Five minutes
Everything else, being subagents, workflows, teammates, forks, and compaction	Five minutes, except server-controlled helper requests, which get one hour	Five minutes

Two consequences follow. First, once you go past your plan’s included usage and Claude Code draws on usage credits, the main conversation drops to the cheaper five-minute TTL, because you are now being billed for it. Second, subagents and workflows never get the hour by default, even on a subscription.

You can override either bucket. promptCacheTtl and CLAUDE_CODE_PROMPT_CACHE_TTL set the main conversation; subagentPromptCacheTtl and CLAUDE_CODE_SUBAGENT_PROMPT_CACHE_TTL set everything else. Both take 5m or 1h and require Claude Code v2.1.242 or later. One-hour writes cost more, so for short bursts that never idle past five minutes the default is already right.

What breaks the cache and what does not

Beyond expiry, some actions invalidate the cache outright, which makes the next request once slower and more expensive.

Switching models. Each model has its own cache. The opusplan setting makes every plan-mode toggle a model switch, and an automatic fallback triggered by a safety classifier is one too. A skill or command whose frontmatter names a different model makes that turn a switch as well
Changing effort level. On most models. On Fable 5.1 with an API key or a Claude subscription the cache survives, from v2.1.260, though not on Bedrock, Google Cloud’s Agent Platform, a Claude apps gateway, with experimental betas disabled, or under a HIPAA configuration
Turning on fast mode, the first time. The header is part of the cache key, so the cost lands once per conversation
Connecting or disconnecting an MCP server. Only when tools load into the prefix. With tool search active, which is the default on supported models, a server appearing or disappearing only appends and keeps the cache
Denying an entire tool, compacting, accumulating many images, and upgrading Claude Code.

What keeps the cache is just as useful to know: editing files in your repository, editing CLAUDE.md mid-session, changing permission mode, changing output style, invoking skills and commands, running /recap, rewinding, and spawning a subagent. Those all either append to the conversation or do not reach the running request at all.

Checking it in your own setup

Run claude -p “hello” –output-format json and read usage.cache_creation. One-hour writes appear under ephemeral_1h_input_tokens and five-minute writes under ephemeral_5m_input_tokens
Run /usage for a per-session summary. After the first response it adds a Prompt cache (main) line showing hit ratio, miss count, and whether the cache is warm, which requires v2.1.251 or later
Read the likely-cause text on that line, such as “likely cause: tool definitions changed”, which requires v2.1.260 or later
Set FORCE_PROMPT_CACHING_5M=1 while comparing the two TTLs, since it forces five minutes for both buckets and outranks everything else

Fable can put you on metered usage without asking twice

Depending on plan and seat tier, Fable usage can bill to usage credits rather than your plan’s included limits. The /model picker marks the Fable row with Requires usage credits when it does, and an interactive session shows a consent prompt before the first billed request.

The catch is where that prompt appears. It is shown only where the session runs, and it is not forwarded to a Remote Control device. A session in a terminal with nobody in front of it ends the turn without sending the request. So the model best suited to unattended work has a consent step that specifically does not follow you out of the room. Decide about Fable before you wire it into anything that runs on its own.

Who presses approve, surface by surface

Surface	Approval	What leaves your machine	How cost shows up
Routine (cloud)	None. No permission-mode picker, and included connectors write without confirmation	Repositories are cloned. Environment variables are visible to everyone using the environment. Connector actions appear as you	Subscription usage per run, plus a daily run cap that varies by plan
Workflow (local)	Confirmed at launch, depending on mode. Each agent follows your normal permission rules	Same as the session	Proportional to agent count. An advisory warning past 25 agents or 1.5M projected tokens under the default guideline
Remote Control	You can press approve from a device. The cost consent prompt is not forwarded	Conversation records sit on Anthropic servers. Execution and files stay local	The same allowance as a normal session
Claude in Chrome	Per-site permission plus mode-dependent confirmation, with session-wide allow available and Auto sometimes not prompting	Your logged-in browser state	Enabling it by default keeps browser tools loaded, which raises context usage
Artifacts	Publishing depends on permission mode. In Auto mode the classifier reviews it and a page can go up unprompted	Private by default. A public link is readable by anyone. Connectors run with the viewer’s permissions	Output tokens, and a styled page uses plenty
Computer use (CLI, macOS only, Pro/Max only, interactive only)	Per app, per session, with warnings on terminals and similar	Your actual desktop	The same as the session

Reading down the approval column is the whole argument of this article. Exactly one surface has nobody in the chair, and it is the one that keeps running with your laptop shut.

Seven things not to hand over

#	Do not hand over	Basis
1	Keys, whether API keys or passwords, as environment variables. On Pro and Max store them as API credentials instead. On Team and Enterprise, where API credentials are not offered, anything in a shared environment’s variables is visible to everyone using that environment	Documentation
2	Final confirmation of an irreversible purchase or publication, on a surface with no approvals	Our policy, following from the structure
3	Connectors on a routine beyond the minimum. Strip the list immediately after creation, because everything is included by default	Documentation plus our own measurement
4	An API trigger token you have not stored properly. It is shown once and cannot be retrieved. The request body arrives wrapped and labelled as untrusted data by design, but do not build on that alone	Documentation
5	Publishing, deleting, or purchasing clicks in Chrome. Keep browser work to reading and checking. A GIF recording captures account details from logged-in pages, per the official caution, and we treat screenshots the same way	Documentation plus our policy
6	Fable on an unattended surface before you have confirmed whether your plan puts it on metered usage	Documentation
7	A connector-backed artifact you intend to publish, since it cannot be shared publicly. And nothing worth storing on a page that will be public	Documentation plus our policy

Two of these are judgements rather than rules, and they are marked as such. The rest are what the documentation says, which is a distinction worth keeping visible when you write your own list.

What to leave running at the 3D printing bench

The test that has held up for us: a surface with no approvals gets work whose output is a report or a branch, never work whose last step changes something in the world.

A weekly repository check that reports which new model files lack print settings: routine, safe, no approvals needed because nothing irreversible happens
A batch check of every STL against wall-thickness rules: workflow, local, approvals inherited from the session
Anything that touches a marketplace listing, a price, or a published page: local session, approved by hand, no exceptions

The short version

A measured turn spent 97 percent of its cost writing the cache, not on input or output rates
Fable 5.1 is double Opus 5 everywhere but cache reads, where it is half, so the choice turns on your read-to-write ratio
The main conversation gets a one-hour cache TTL only on a subscription within plan usage; subagents and workflows get five minutes by default
Model switches, effort changes, and the first fast-mode turn break the cache; permission mode, output style, skills, and /recap do not
The Fable usage-credits consent prompt is never forwarded to a remote device
Routines are the only surface with nobody pressing approve, which is exactly why their connector list and network policy deserve the attention