Auto mode

Auto mode is a permission mode where Claude can run tools without asking you each time. After hooks and explicit permission rules, a separate classifier reviews actions that still require an auto-mode decision. It is not the same as sandboxing: sandboxing limits Bash subprocesses at the OS level.

Official guide: Choose a permission mode (section Eliminate prompts with auto mode).

Starting August 14, 2026, auto mode is the default for new Pro, Max, and Team sessions unless you or your organization already set another default. It is still available on other eligible account and provider combinations, but is not necessarily their starting mode.

Requirements (all must be true)

From the current documentation:

• Plan: all plans.
• Team / Enterprise: auto mode is available by default unless an administrator disables it with managed permissions.disableAutoMode: "disable".
• Model on the Anthropic API and Claude Platform on AWS: Opus 4.6 or later, Sonnet 4.6 or later, or the Fable 5 family.
• Model on Bedrock, Google Cloud’s Agent Platform, Foundry, and signed-in Claude apps gateway sessions: Sonnet 5, Opus 4.7 or later, or the Fable 5 family.
• Provider: Anthropic API, Claude Platform on AWS, Bedrock, Google Cloud’s Agent Platform, Foundry, and signed-in Claude apps gateway sessions are supported. Older models, Haiku, and Claude 3 models are not.

If auto mode is unavailable, first check these requirements and managed disableAutoMode settings. Anthropic can also disable it server-side or reject it for an account, and classifier failures can be transient. See the error reference.

How it behaves

• Evaluation order: PreToolUse hooks run first, then explicit deny, ask, and allow rules, followed by the active mode and classifier where needed. Ordinary in-scope reads and edits can bypass classifier review; protected paths, shell, and network actions follow their applicable rules.
• Broad allow rules are dropped when you enter auto mode (for example blanket Bash(*), wildcard interpreters, package-manager run commands, broad Agent allows). Narrow rules like Bash(npm test) remain. Dropped rules return when you leave auto mode.
• Boundaries in chat: If you say things like do not push or wait for my review before deploy, the classifier treats that as a block signal until you lift it in a later message. Compaction can drop that context; for a hard guarantee use permissions.deny.
• Fallback: After 3 blocks in a row or 20 total in a session, auto mode pauses and Claude Code prompts again. In headless -p mode, repeated blocks can abort the session. Thresholds are not configurable.

Denied actions show in /permissions (Recently denied); you can retry with manual approval.

What the classifier tends to block or allow

Defaults evolve; treat the lists as orientation, not a contract. claude auto-mode defaults prints the full rule lists on your install.

Often blocked (examples from docs): curl | bash style installs, production deploys / migrations, mass cloud deletes, IAM / repo permission grants, force pushes, and modifications to shared infrastructure.

Often allowed (examples): normal local file work in the working tree, dependencies from manifests / lockfiles, read-only HTTP, and pushes to repository branches that match the request. Sensitive-content checks, deploy-like branches, explicit ask / deny rules, and branch protection still apply. Sandbox network requests are not blindly allowed; they go through the classifier.

Teams can document trusted infrastructure via autoMode.environment; see Configure auto mode.

Subagents, cost, and switching

• Subagents: the classifier checks spawn, each action, and a final return review. Subagent permissionMode in frontmatter is ignored while auto mode is active on the parent.
• Cost / latency: classifier checks add a round trip. They count toward token usage on Enterprise and accounts using the API or third-party cloud providers; they do not count against Pro, Max, or Team usage limits.
• How to enable: Shift+Tab (when your account supports it), --permission-mode auto, or persist "defaultMode": "auto" under permissions in user (~/.claude/settings.json) or managed settings. Project and local settings cannot grant their repository auto mode. In sessions started by the VS Code extension, select Auto from the mode indicator instead.

Example prompt (session boundaries)

Use this shape when you turn auto mode on mid-session so classifier context picks up guardrails (still pair with permissions.deny for hard stops):

Auto mode is on for this task. Non-negotiable: no git push, no production deploy commands, no database migrations, no edits under infra/. Local dev, tests, and edits in the app folder are OK. Acknowledge, then <describe your actual task>.

See also