Claude Code permission modes and the Auto Mode classifier
permission ladder (tight -> loose)
plan
ask before anything
default
ask on risky ops
acceptEdits
writes auto; exec asks
auto
classifier approves
dontAsk
no prompts
bypassPermissions
throwaway sandbox
Auto Mode (March 24, 2026) — action-review classifier
proposed action
tool + payload
from agent loop
classifier model
separate model
reviews each action
before it runs
escalation block
blocks actions that
escalate beyond
the request
HITL
blocked actions
fall to user
approved -> execute immediately
hard-block on priv-esc / exfil shapes
budget controls are non-negotiable (Lesson 13)
max_turns = hard cap on agent loop iterations
max_budget_usd = dollar kill switch; aborts session on breach
per-tool caps = e.g. no more than N WebFetch calls per session
Availability depends on plan, org enablement, model, and provider; classifier is a layer, not a solution.