What is auto permission mode in Claude Code?

claude --permission-mode auto

The built-in starting mode on Pro, Max, and Team plans.

Answer

Auto mode replaces routine permission prompts with a review by a second model, the classifier, which blocks actions that escalate beyond your request, target unrecognized infrastructure, or look driven by hostile content Claude read. It is the built-in starting mode on Pro, Max, and Team plans, and requires a recent model. Explicit ask rules still prompt.

What it does

Auto mode moves the review step from you to a second model.

claude --permission-mode auto

That model — the classifier — reads each action before it runs and blocks anything that escalates beyond what you asked for, targets infrastructure it does not recognise, or looks like it came from hostile content Claude read somewhere.

It trusts your working directory and the git remotes that were configured when the session started. A remote added or repointed mid-session with git remote add or git remote set-url is not trusted.

On Pro, Max, and Team plans this is the mode interactive sessions start in — but not claude -p or the Agent SDK. That exception catches scripts: an automated run starts in Manual unless it passes --permission-mode auto itself.

Explicit ask rules still force a prompt. So do connector tools your organisation set to ask, and MCP tools marked as requiring user interaction.

One consequence surprises people, because it looks like a rule breaking. Entering auto mode drops your broad allow rules — the ones that amount to arbitrary code execution:

blanket Bash(*) or PowerShell(*)
wildcarded interpreters such as Bash(python*)
package-manager run commands
Agent allow rules

Narrow rules like Bash(npm test) carry over untouched, and the dropped ones come back when you leave the mode. The reasoning is that a rule granting everything would hand the classifier nothing to review.

What your account needs

Availability and starting mode are two different things. The mode is available on every plan; what Pro, Max and Team additionally get is sessions that *start* in it. On the organisation plans — Team and Enterprise — it is on by default, and an administrator can turn it off for everyone.

The requirement that catches people out is the model, and it differs by provider:

Anthropic API and Claude Platform on AWS — Opus 4.6 or later, Sonnet 4.6

or later, or Fable 5

**Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry, and

signed-in Claude apps gateway** — only Sonnet 5, Opus 4.7 or later, and Fable 5

Older models are not supported anywhere. If the mode is missing, this is the first thing to check.

When to use it

Auto mode suits sustained work where the direction is settled and the individual steps are not worth interrupting for:

a long task you have already scoped and want to run to completion
exploratory work in a repository you own, where the blast radius is local
sessions where prompt fatigue is the real risk — approving without reading is

worse than not being asked

When not to use it

Not for operations where being wrong is expensive and irreversible: production deploys, credential changes, anything touching infrastructure you cannot rebuild. The classifier catches a lot, but it is a judgement, not a boundary.

If what you want is a Claude that pushes work forward on its own but still asks before acting, that is a different setting entirely: the Proactive output style changes how Claude behaves, not who approves it.

Example

Start a session in auto mode:

claude --permission-mode auto

Set it as your default in ~/.claude/settings.json:

{
  "permissions": {
    "defaultMode": "auto"
  }
}

The file matters. In Claude Code v2.1.142 and later, defaultMode: "auto" has no effect from .claude/settings.json or .claude/settings.local.json — it has to be in your user settings. If a session starts in Manual mode with no error, that is usually why.

Administrators can remove the mode entirely through managed settings:

{
  "permissions": {
    "disableAutoMode": "disable"
  }
}

This drops auto from the Shift+Tab cycle, and a session started with --permission-mode auto starts in Manual instead.

Security considerations

The classifier is a model reviewing another model's actions. It shifts the failure mode rather than removing it: instead of you approving something you did not read, the classifier approves something it misjudged.

What it blocks by default includes actions that escalate beyond your request and anything reaching unrecognised infrastructure. What it cannot do is know which of your systems matter. A destructive command inside your own project, clearly implied by your own prompt, is exactly the kind of thing it lets through.

Two practical habits: commit before starting a long auto-mode session, and keep ask rules on the operations you always want to see — they still prompt here.

Common mistakes

Reading "auto" as "unattended". The mode reduces prompts. It does not make the session safe to leave running against anything you would not want rebuilt.

Putting defaultMode: "auto" in project settings. It is ignored there from v2.1.142 onward. Move it to ~/.claude/settings.json.

Assuming it is unavailable temporarily. If Claude Code reports auto mode as unavailable, an account requirement is unmet — plan, organisation policy, model, or provider. It is not a transient outage. A different message, naming a model and saying it "cannot determine the safety" of an action, is a failed classifier request and usually is transient.

Expecting it on an older model. Sonnet 4.5, Opus 4.5, Haiku, and claude-3 models do not support auto mode on any provider.