Claude Automode: Setup, Safety, and Permission Modes

Direct answer

Claude Automode usually means Claude Code auto mode. It lets Claude Code execute routine tool calls without asking for every permission. A separate classifier reviews actions first and blocks work that appears destructive, irreversible, outside the trusted environment, or unrelated to the request. This reduces prompts. It does not guarantee safety or replace human review.

Summary

Auto mode is a permission mode, not a different Claude model or a separate Auto Claude product.
Tool calls receive classifier review before risky or out-of-scope actions can execute.
Explicit ask and deny rules run before the classifier and keep human or absolute boundaries in place.
Compared with bypass permissions, auto mode keeps more safeguards. Anthropic still recommends isolation for higher-risk work.
The default trust boundary is the working directory and the current repository's configured remotes.
Add trusted repositories, domains, buckets, services, and sensitive locations through `autoMode.environment`.
Start with a clean worktree, least-privilege credentials, narrow task scope, tests, and a required final review.

What is Claude Code auto mode?

By default, Claude Code asks before actions that can change files or run commands. The mode delegates many permission decisions to a model-based classifier. Safe-looking calls continue without interruption. Blocked calls return to Claude so it can try another approach. Repeated blocks can still lead to a human prompt.

Anthropic describes auto mode as a middle path between repeated manual approval and `--dangerously-skip-permissions`. Bypass mode removes most permission checks and should only run inside strong isolation. Classifier and explicit rules remain in auto mode, but mistakes are possible.

Read Anthropic's auto mode announcement and its stated limits.

How the auto mode classifier works

Claude proposes a tool call from the task, repository context, instructions, and session conversation.
Permission deny and content-scoped ask rules run first. A matching rule blocks or prompts without classifier approval.
Next, the classifier evaluates the action against the task, trusted environment, and built-in safety rules.
Allowed actions execute. Claude receives a denial for blocked actions and can choose a safer route.
The session records blocked actions under the Recently denied section of `/permissions`.
A person can authorize one retry, add needed environment context, or create a narrow rule after review.

Current documentation says the classifier sees user messages, tool calls, and CLAUDE.md content. Tool results are stripped before classifier review. A separate server-side check looks for suspicious content before Claude reads incoming results.

Read Anthropic's engineering explanation of the classifier and the behavior it can miss.

Permission mode comparison

Manual: use when each risky edit or command deserves a conscious decision.
Accept edits: use when file changes can proceed but other shell actions should keep normal prompts.
Plan: use for investigation and a proposed approach before implementation.
Auto: use for a trusted task direction that needs longer execution with classifier review.
Don't ask: use explicit rules to decide what proceeds, while unmatched requests are denied instead of prompting.
Bypass permissions: use only in an isolated container or virtual machine where the agent cannot cause meaningful damage.

This mode is not identical to accept edits. It can approve more than file changes after classifier review. It also differs from bypass mode because the classifier and explicit boundaries remain active.

Compare current permission modes, availability, model requirements, and interface behavior.

Availability and current requirements

Auto mode is generally available across plans when the account, provider, organization policy, and selected model meet current requirements. Team and Enterprise administrators can disable it through managed settings. Unsupported models do not show the option.

Plans: current documentation lists all plans, subject to provider and model requirements.
Organization: Team and Enterprise administrators can set `permissions.disableAutoMode` to `disable`.
Anthropic API and Claude Platform on AWS: supported models currently start with Opus 4.6, Sonnet 4.6, or Fable 5.
Bedrock, Google's Agent Platform, Microsoft Foundry, and signed-in app sessions: requirements currently use newer supported models.
Failure message: an unavailable-account notice means a requirement is not met, while a classifier request failure may be transient.

Anthropic's documentation says auto mode becomes the default for new Pro, Max, and Team sessions on 14 August 2026. Existing user or managed defaults remain unless changed or accepted through the one-time prompt. Users can switch modes at any time.

How to enable Claude Automode

Update Claude Code so current model, provider, and rule behavior apply.
Confirm the organization has not disabled auto mode and select a supported model.
In a terminal session, cycle available modes with Shift+Tab or start with `--permission-mode auto`.
In supported desktop, IDE, web, or mobile interfaces, choose Auto from the visible mode selector.
To make Auto the default, set `permissions.defaultMode` to `auto` in user or managed settings.
Verify the active mode in the status indicator before leaving a task unattended.

Current versions ignore an Auto default in checked-in project settings. This prevents a cloned repository from granting itself autonomous permissions. Put the default in user or managed settings. Local folder selections can still affect the current folder or session.

Configure trust boundaries and human checkpoints

The default classifier trusts the working directory and configured remotes for the current repository. Company repositories, package registries, cloud buckets, domains, services, and sensitive data locations need accurate environment context. Unknown destinations can look like data-exfiltration targets.

Keep `$defaults` in `autoMode.environment`, then add only the organization's real trusted infrastructure.
Name sensitive data locations and the audiences that may receive their content.
Name protected infrastructure scopes, production systems, and remote targets that deserve stricter handling.
Use `permissions.ask` when a human must approve an action, such as every push or pull-request creation.
Use `permissions.deny` to prohibit an action. Deny rules block before classifier review.
Keep allow rules narrow. Broad shell, interpreter, and package-script approvals can grant arbitrary code execution.
Inspect the built-in rules with `claude auto-mode defaults` and the effective result with `claude auto-mode config`.
Run `claude auto-mode critique` to find ambiguous or redundant custom classifier rules.

Current auto mode permits pushes to branches in the working repository, including its default branch, and permits pull-request creation by default. Add explicit ask rules if every push and PR needs a person. Do not assume the classifier creates that checkpoint for you.

Use the current auto mode configuration reference for environment, ask, deny, allow, inspection, and denial workflows.

Run a least-privilege auto mode pilot

Choose a low-risk, reversible task with clear acceptance criteria and no need for production access.
Create a clean branch or worktree. Save or commit existing work so unexpected changes are visible and recoverable.
Use a sandbox, container, or limited account. Remove production credentials and unnecessary network access.
State the exact scope, directories, tests, prohibited actions, stop conditions, and review points in the prompt.
Add ask rules for pushes, PRs, package publication, deployment, migrations, and other external changes that need a person.
Run the task while observing initial behavior. Review denials instead of weakening rules after the first interruption.
Inspect the complete diff, generated files, dependency changes, tests, logs, and remaining processes.
Use an independent review and required CI checks before committing, pushing, deploying, or merging.

Good and poor auto mode tasks

Refactor fit: a test-backed change inside one repository with clear file and behavior boundaries.
Generation fit: routine code creation followed by formatting, type checks, tests, and diff review.
Update fit: a documented dependency change in an isolated branch with a locked verification path.
Human decisions needed: avoid ambiguous product work that depends on users, security, legal, or operations.
Production risk: avoid direct access, destructive migrations, secret rotation, incident response, or unreviewed infrastructure changes.
Unknown boundary: avoid work across unfamiliar repositories, accounts, or services without a trust definition and rollback plan.

Cost, latency, and false blocks

Classifier calls can add a small amount of token use, cost, and latency. Broad classification settings can increase that overhead. Unclear intent or environment context can cause false blocks or risky approvals. Measure interruption rate and review effort during the pilot.

A denial is not a reason to disable safeguards. Check the attempted action and destination. Add trusted environment context for recurring internal targets. Create a narrow allow rule only for repeatable safe work. For one intended action, state the intent and retry after review.

Use Better Design's Claude Code project instructions guide to keep repository rules concise and reviewable.

For longer tasks, pair the permission plan with the Claude Code sessions and memory guide.

Frequently asked questions

It reduces risk compared with bypass permissions, but it does not guarantee safety. Anthropic says the classifier can allow risky actions or block benign ones. Use isolation, least privilege, explicit rules, and human review.

No. Classifier review and explicit permission rules remain active. Bypass permissions skips most prompts and checks. Anthropic recommends bypass only inside isolation where the agent cannot cause meaningful damage.

The selected model, provider, account, Claude Code version, or organization setting may not meet the requirements. Check the current permission-mode table. An administrator may also have disabled auto mode through managed settings.

No. Current Claude Code versions ignore an Auto default from checked-in project settings. Set the default in user or managed settings so a cloned repository cannot grant itself autonomous permission.

Use auto mode for trusted direction, not blind trust

Claude Code auto mode can make long tasks practical without removing every safeguard. Its value depends on precise scope, a correct trust boundary, explicit human checkpoints, isolation, and final review. Start with one reversible task, inspect every denial and output, then expand access only from evidence.

Connect Better Design