Choosing the Right Mode: Agent vs. Ask

You ask the AI a quick question about your Express payment handler — “why does processPayment sometimes double-charge?” — and thirty seconds later it has silently rewritten four files, changed the Stripe idempotency logic, and edited a migration you never wanted touched. Now you are reviewing a diff you didn’t ask for, on a critical path, under time pressure.

That failure mode is almost always a mode problem, not a model problem. The AI was in execution mode when it should have been read-only. Every modern coding tool exposes this split — read-only exploration versus read-write execution — and using the wrong one is the single fastest way to turn a five-minute question into an hour of cleanup.

What You’ll Walk Away With

• A two-phase workflow (explore read-only, then execute) that keeps AI from editing files you never agreed to touch
• The exact toggle, flag, or approval policy for read-only vs. execution mode in Cursor, Claude Code, and Codex
• A copy-paste exploration prompt that produces a reviewable refactor plan without changing a single line
• A scoped execution prompt that limits the AI to one step at a time, with a checkpoint before it continues
• The failure modes to watch for when execution mode runs ahead of your review

The Two Core Modes

Think of these as two stances you take with your AI partner. Every tool implements them differently, but the distinction is universal.

Read-Only: The Explorer

Purpose: Learning, planning, and questioning.

The AI searches your codebase, reads files, traces call sites, and answers questions — but it cannot edit anything or run mutating commands. This is Cursor’s Ask mode, Claude Code’s plan mode, and Codex’s read-only sandbox. Use it to build a shared, accurate understanding before any code changes.

Read-Write: The Implementer

Purpose: Execution, refactoring, and action.

The AI edits files, runs commands, and fixes errors to carry out an approved plan. This is Cursor’s Agent mode, Claude Code’s default / accept-edits modes, and Codex with a workspace-write sandbox plus an explicit approval policy. Use it only once you have a plan you trust.

The Strategic Workflow: Explore, Then Execute

The reliable pattern is to start read-only to understand and plan, review that plan, and only then switch to execution mode for one scoped step at a time. Here is the same workflow in each tool.

Cursor

Open the chat pane and use the mode dropdown at the bottom of the input box to select Ask. Cursor will read files and answer but never edit. @-mention the handler (@src/routes/payments.ts) so it has precise context, run your exploration prompt, then review the plan it produces.

When the plan looks right, switch the dropdown to Agent and paste your scoped execution prompt. Cursor creates a checkpoint before each set of edits, so you can roll back to any prior state if a step goes wrong, and you accept or reject each diff per hunk.

Claude Code

Start in plan mode for read-only exploration. Either launch with claude --permission-mode plan, or press Shift+Tab to cycle from Normal into Auto-Accept and then Plan mode (⏸ plan mode on appears at the bottom of the terminal). In plan mode Claude analyzes and proposes, but makes no edits.

Once you approve the plan, exit plan mode and let Claude execute. Stay in default mode if you want to approve each command, or Shift+Tab into accept-edits (⏵⏵ accept edits on) to auto-apply file edits while still being prompted for shell commands.

Codex

Begin read-only so Codex can explore without touching anything:

codex --sandbox read-only "explain why processPayment double-charges and propose a fix plan"

For interactive execution, configure the two controls explicitly: the sandbox defines what Codex can access, while the approval policy defines when it may ask to cross that boundary. With workspace-write and on-request, routine edits and commands inside the workspace can proceed without a prompt; Codex asks when it needs an action outside the sandbox:

codex --sandbox workspace-write -c approval_policy=on-request \
  "execute step 1 of the plan only, then stop and report"

For tighter filesystem control, keep approval_policy=on-request and switch the sandbox to read-only. Reserve danger-full-access for disposable, explicitly trusted environments.

Note

The mechanics differ, but the discipline is identical across all three tools: read-only first to produce a plan you can review, execution mode second to carry it out one step at a time.

The exploration prompt

Run this in read-only mode (Cursor Ask, Claude Code plan mode, or codex --sandbox read-only). It forces a plan without any edits.

Tip

Map and plan a refactor without changing anything:

In read-only/plan mode: map every call site of processPayment in src/, list which modules import it, and identify where Stripe idempotency keys are set. Then produce a refactor plan to make the handler safely idempotent, as a numbered TODO where each step names the exact files it touches and the tests that cover it. Do not edit anything yet — output the plan only.

The scoped execution prompt

Once the plan is reviewed, switch to execution mode and constrain the AI to a single step with a hard stop.

Tip

Execute exactly one step, then stop:

Execute step 1 of the plan only: add an idempotency key derived from the request to processPayment and pass it to the Stripe charges.create call. Update the 3 call sites you listed. Run npm test -- payments and paste the results. Stop and report before touching step 2 — do not start the next step until I confirm.

Tip

Force a self-review before you accept the diff:

Before I accept these edits, review your own diff as a hostile senior reviewer on a payment path: list every edge case, error path, and concurrency concern you did NOT handle, and call out anywhere you guessed at business rules instead of reading them from the code. Be specific about line numbers.

When This Breaks

Even with the right mode, this workflow has predictable failure points:

• Agent runs ahead of an unreviewed plan. If you skip the read-only phase, the AI executes against its own assumptions. Always review the plan as a discrete artifact before switching modes.
• Cursor Agent edits files you didn’t intend. A vague prompt in Agent mode invites scope creep. Name the files in your prompt, and use checkpoints to roll back if it wanders. Reject hunks that touch anything off-plan.
• The Codex workspace sandbox includes sensitive repo files. workspace-write can edit files such as .env or deploy manifests when they are inside the workspace; on-request does not prompt for every such edit. Keep secrets out of the workspace and use read-only until the plan is reviewed on sensitive repositories.
• Plan mode hands you a plan that’s subtly wrong. Read-only mode doesn’t make the plan correct — it makes it reviewable. The self-review prompt above is your second line of defense before any code lands.

What’s Next

• The Human in the Loop — the review gates and oversight habits that pair with mode discipline
• Best Practices for AI-Assisted Development — the full Plan-Execute-Verify workflow this mode split fits into