Auto mode in Claude Code: fewer permission prompts with a safety classifier

Use Claude Code long enough and you hit "permission fatigue": clicking Allow dozens of times an hour, until you click by reflex without reading the command. The old escape was bypassPermissions, which turns off nearly all checks and is too risky on a real machine. Auto mode is the middle path: a separate classifier model reviews each action before it runs, letting normal work through and blocking anything beyond what you asked for. Since v2.1.283, auto mode is the default starting mode for interactive terminal and VS Code sessions.

How it works: the decision order

1. Rules: allow, ask and deny rules in settings apply first (with exceptions, e.g. writes to protected paths still go to the classifier).
2. Built-in approvals: read-only actions and file edits in the working directory.
3. Classifier: everything else, mostly shell and network operations.
4. Verdict: if blocked, Claude gets the reason and finds another way.

On entering auto mode, overly broad allow rules like Bash(*) are dropped; narrow rules like Bash(npm test) stay.

Blocked by default

Pushing to branches of the current repo is still allowed unless secrets are involved.

Enabling and configuring

claude --permission-mode auto      # or Shift+Tab to cycle modes

// ~/.claude/settings.json
{ "permissions": { "defaultMode": "auto" } }

Setting "auto" in project-level settings has no effect: a repo can't switch on auto mode for you. The knobs:

• autoMode.environment: declare the repos, buckets and services you trust.
• autoMode.allow: allow routine patterns that are otherwise blocked.
• claude auto-mode defaults: print all default rules as JSON.
• CLAUDE_CODE_AUTO_MODE_MODEL: change the classifier model (default Sonnet 5).

Compared with other modes

Deny rules apply in every mode.

Cost and limits

• On Enterprise and API accounts, classifier calls count toward tokens. Each check adds a round trip, mostly for shell and network commands.
• After 3 consecutive blocks, or 20 in a session, auto mode pauses and returns to prompting. These thresholds can't be changed.
• The classifier rereads instructions in the conversation ("don't push"). When the conversation is compacted, those can be lost. For a hard guarantee, use a deny rule.
• Supported models: Opus/Sonnet 4.6 or later, Haiku 5.5, Fable (via the Anthropic API). Team/Enterprise admins can disable it with permissions.disableAutoMode.

How to apply it

• Dev: Use auto mode for tasks where you trust the direction. Add permissions.ask for commands you want to approve yourself, like Bash(git push *).
• Tech Lead: Write deny rules for what must never happen (reading .env, editing infra/prod). Combine with the Bash sandbox for two layers of protection.
• PM/Admin: Track classifier cost on API accounts; report false positives with /feedback.