It’s bizarre to me that Claude Code doesn’t have more guardrails on plan mode. I mostly use Copilot and the plan mode there has teeth. In plan the agent does not have permission to write to the filesystem outside of a temp directory and the plan document itself, and tool calling is heavily restricted.

There’s also a “ask” mode which is read only. Both are enforced by the permissions model, not just a system prompt instruction. I’ve seen the model “forget” and try to start coding - it bounces off a hard permissions failure and that “reminds” it that it’s in plan mode.