Manual approval prompts degrade when nearly every prompt is accepted. Anthropic reports that users approved roughly 93% of Claude Code permission requests, creating a weak supervision loop. Auto Mode targets the space between that repeated clicking and --dangerously-skip-permissions.
The execution policy has three tiers. Built-in read-only tools and narrow user rules form the first fast lane. Writes inside the project form a second lane because version control makes them reviewable. Shell commands, network access, external tools, subagents, and filesystem operations outside the project reach a transcript classifier.
The classifier sees user messages and executable tool calls, while assistant prose and tool results are removed. This prevents the agent from persuading its own approver and keeps hostile fetched content out of the decision transcript. A separate prompt-injection probe screens tool outputs before the main agent reads them, so input and action controls remain independent.
Classification is split into two stages. A fast one-token filter is tuned to block cautiously; only flagged actions reach a reasoning pass. On 10,000 internal tool calls, the first stage produced an 8.5% false-positive rate, while the full pipeline reduced it to 0.4%. That reduction costs recall: the deployed pipeline missed 17% of 52 real overeager actions and 5.7% of 1,000 synthetic exfiltration attempts.
Anthropic therefore positions Auto Mode as an improvement over no guardrails, not a replacement for careful review on high-stakes infrastructure. A denial returns to Claude as a tool result, allowing a safer attempt instead of terminating the session. Three consecutive denials or 20 total denials escalate to a person; headless sessions terminate.
For New Runtime, the transferable pattern is a reasoning-blind action gate with explicit residual-risk metrics. Keep cheap deterministic lanes for narrow operations, evaluate consequential actions against the user’s actual authorization, and make a false positive recoverable without turning a repeated denial into an endless bypass loop.