---
schema_version: "newruntime-agent-readable-v0.2"
type: "post"
stable_id: "post:claude-code-auto-mode-action-gate"
slug: "claude-code-auto-mode-action-gate"
title: "Claude Code Auto Mode Gates Actions Instead Of Explanations"
description: "Claude Code Auto Mode combines an input injection probe with a two-stage action classifier, preserving autonomy while exposing an honest residual miss rate."
retrieval_nugget: "Claude Code Auto Mode combines an input injection probe with a two-stage action classifier, preserving autonomy while exposing an honest residual miss rate. Manual approval prompts degrade when nearly every prompt is accepted. Anthropic reports that users approved roughly 93% of Claude Code permission requests, creating a weak supervision loop."
status: "published"
published_at: "2026-08-03"
updated_at: "2026-08-03"
record_date: "2026-08-03"
date_kind: "published_at"
topics: ["agent-security","coding-agents","agent-harnesses","evals"]
source_urls: ["https://www.anthropic.com/engineering/claude-code-auto-mode"]
visuals: [{"id":"claude-code-auto-mode-action-gate","kind":"editorial-diagram","role":"hero","src":"https://newruntime.com/images/posts/claude-code-auto-mode-action-gate.webp","alt":"Hand-drawn action pipeline where safe tools and project edits follow fast lanes, risky actions pass through a two-stage classifier, tool results pass through an injection probe, and repeated denials escalate to a person.","caption":"The classifier judges executable actions against user intent while a separate probe screens the content entering the agent loop.","credit":"New Runtime synthesis from Anthropic","source_url":"https://www.anthropic.com/engineering/claude-code-auto-mode","generated_with":"gemini-3.1-flash-image","width":1600,"height":900,"legend":[{"label":"Fast lanes","description":"Read-only tools and reviewable project edits avoid classifier latency."},{"label":"Action gate","description":"Shell, network, external tools, and out-of-project access are checked before execution."},{"label":"Input probe","description":"Suspicious tool output receives a warning before it enters the main agent context."},{"label":"Deny and continue","description":"A blocked action returns as a tool result so the agent can attempt a safer route."}]}]
routes: {"html":"https://newruntime.com/posts/claude-code-auto-mode-action-gate/","markdown":"https://newruntime.com/posts/claude-code-auto-mode-action-gate.md","json":"https://newruntime.com/posts/claude-code-auto-mode-action-gate.json"}
source_format: "markdown"
---

# Claude Code Auto Mode Gates Actions Instead Of Explanations

## Retrieval answer

Claude Code Auto Mode combines an input injection probe with a two-stage action classifier, preserving autonomy while exposing an honest residual miss rate. Manual approval prompts degrade when nearly every prompt is accepted. Anthropic reports that users approved roughly 93% of Claude Code permission requests, creating a weak supervision loop.

Manual approval prompts degrade when nearly every prompt is accepted. Anthropic reports that users approved roughly 93% of Claude Code permission requests, creating a weak supervision loop. Auto Mode targets the space between that repeated clicking and `--dangerously-skip-permissions`.

The execution policy has three tiers. Built-in read-only tools and narrow user rules form the first fast lane. Writes inside the project form a second lane because version control makes them reviewable. Shell commands, network access, external tools, subagents, and filesystem operations outside the project reach a transcript classifier.

The classifier sees user messages and executable tool calls, while assistant prose and tool results are removed. This prevents the agent from persuading its own approver and keeps hostile fetched content out of the decision transcript. A separate prompt-injection probe screens tool outputs before the main agent reads them, so input and action controls remain independent.

Classification is split into two stages. A fast one-token filter is tuned to block cautiously; only flagged actions reach a reasoning pass. On 10,000 internal tool calls, the first stage produced an 8.5% false-positive rate, while the full pipeline reduced it to 0.4%. That reduction costs recall: the deployed pipeline missed 17% of 52 real overeager actions and 5.7% of 1,000 synthetic exfiltration attempts.

Anthropic therefore positions Auto Mode as an improvement over no guardrails, not a replacement for careful review on high-stakes infrastructure. A denial returns to Claude as a tool result, allowing a safer attempt instead of terminating the session. Three consecutive denials or 20 total denials escalate to a person; headless sessions terminate.

For New Runtime, the transferable pattern is a reasoning-blind action gate with explicit residual-risk metrics. Keep cheap deterministic lanes for narrow operations, evaluate consequential actions against the user's actual authorization, and make a false positive recoverable without turning a repeated denial into an endless bypass loop.