Skip to content

Claude Code Auto Mode: Configuration Guide for Safe Permission Management

Summary

Reza Rezvani's day-one configuration guide for Claude Code's auto mode — the new permission tier between constant approval prompts and --dangerously-skip-permissions. Covers the Sonnet 4.6 classifier mechanics, the three-scope settings hierarchy, supply chain risks with unpinned dependencies, and why auto mode should be layered with OS-level sandboxing.

Key Details

  • Auto mode uses a dedicated Sonnet 4.6 classifier (independent of your session model) to evaluate every tool call against environment, allow, and soft_deny rules
  • Setting allow or soft_deny in your config replaces the entire default list for that section — always start from claude auto-mode defaults output
  • Configuration reads from user settings, project-local settings, and managed settings — but deliberately NOT from shared .claude/settings.json in repos (security design: a compromised repo can't inject allow rules)
  • Supply chain attacks pass through: unpinned pip install -r requirements.txt is auto-allowed by default
  • Recommended decision matrix: default mode (unfamiliar code), acceptEdits (active watching), auto mode (long-running trusted tasks), plan mode (review only), bypassPermissions (disposable containers only)

Why Rolf Thinks This Matters

We already use auto mode as our recommended permission setting in the global CLAUDE.md. This article validates our setup and highlights configuration pitfalls we should check — particularly the "replacing entire default list" gotcha when customizing allow/soft_deny rules, and the supply chain risk with unpinned dependencies passing through the classifier unblocked.

Further Reading