How we built Claude Code auto mode: a safer way to skip permissions

This post introduces 'auto mode' for Claude Code, a new permissioning system that delegates approval of agent actions to model-based classifiers. It addresses the trade-off between user friction (approval fatigue) and safety by introducing two layers of defense: a server-side prompt-injection probe for tool outputs and an output-layer transcript classifier. The classifier operates in two stages (fast single-token filter and chain-of-thought reasoning) to evaluate actions against user intent and block dangerous operations like scope escalation, credential exploration, and data exfiltration. The system categorizes dangerous actions into overeager behavior, honest mistakes, prompt injection, and misaligned models, with defenses tuned for the first two. It also details a tiered approach to action evaluation, allowing safe tool usage and in-project file operations without classification, reserving the classifier for actions with real downside potential. The classifier's prompt is customizable with slots for environment trust boundaries, block rules, and allow exceptions, shipping with conservative defaults.