Claude Code Auto Mode: Stop Permission Prompts Safely

If Claude Code keeps asking for permission in Auto Mode, do not jump to bypassPermissions. First put the autoMode block in ~/.claude/settings.json, preserve "$defaults", describe your trusted destinations, and inspect the effective configuration with claude auto-mode config. Keep explicit ask rules for actions such as git push, and use the Bash sandbox to auto-allow routine commands that stay inside the boundary.

The result should be boring in the best way: tests, formatting, and local file edits continue without interruption; a push, production access, or an unknown destination still stops for review.

Auto Mode, Sandbox, and Permission Rules Are Different Gates

Claude Code can evaluate one tool call through several layers. Treat them as complementary controls, not interchangeable switches.

Auto Mode does not mean "approve everything." Anthropic's classifier still blocks risky or external actions, while explicit ask and deny rules take precedence. That is why a correctly configured session can run pnpm test without interruption and still prompt before git push.

Prerequisites

Before changing the configuration:

1. Update Claude Code to a version that supports Auto Mode. autoMode.classifyAllShell requires version 2.1.193 or later, and claude auto-mode reset requires 2.1.212 or later.

2. Start in a repository you can restore, with uncommitted work reviewed or backed up.

3. Know which source-control organization, package registry, internal domains, buckets, and deployment targets are actually trusted.

4. Decide which operations must always prompt and which must never run.

Do not copy a company's trust list into your own settings. A trusted destination is a security decision, not a convenience label.

A Safe Five-Minute Configuration

1. Put Auto Mode in user settings

Edit ~/.claude/settings.json. Do not put autoMode in a repository's .claude/settings.json or .claude/settings.local.json: current Claude Code releases ignore it there so a repository cannot grant itself broader trust.

Start with this minimal shape and replace the example organization:

{
  "permissions": {
    "defaultMode": "auto",
    "ask": ["Bash(git push *)", "Bash(gh pr create *)"]
  },
  "autoMode": {
    "environment": ["$defaults", "Source control: github.com/acme and all repositories under it"],
    "classifyAllShell": true
  },
  "sandbox": {
    "enabled": true,
    "autoAllowBashIfSandboxed": true,
    "allowUnsandboxedCommands": false
  }
}

This configuration does four useful things:

• defaultMode starts Claude Code in Auto Mode.

• permissions.ask preserves human review for pushes and pull-request creation.

• "$defaults" keeps Anthropic's built-in environment and protection rules while adding your source-control organization.

• classifyAllShell sends every shell command through the Auto Mode classifier instead of letting narrow Bash allow rules resolve first.

classifyAllShell adds classifier latency to each shell command. If that tradeoff is not useful for your environment, omit it instead of setting broad shell allow rules.

2. Inspect the rules Claude Code will use

Run:

claude auto-mode defaults
claude auto-mode config
claude auto-mode critique

Expected result: defaults prints the built-in rule lists, config shows those defaults plus your source-control entry, and critique flags ambiguous or redundant custom rules. If your organization entry is missing, confirm that you edited ~/.claude/settings.json, not a project-local settings file.

3. Enable and verify the Bash sandbox

Inside Claude Code, run:

/sandbox

Enable sandboxing with automatic permission for sandboxed Bash commands. With allowUnsandboxedCommands set to false, a command that cannot run inside the sandbox fails closed instead of silently escaping it.

Expected result: a routine local command such as your repository's read-only test or formatter command can run without a permission prompt, while access outside the sandbox's filesystem or network boundary is denied or sent to the appropriate gate.

4. Run a controlled boundary test

Ask Claude Code to perform these checks in a disposable branch:

1. Read a normal source file.

2. Run one targeted unit test.

3. Create and remove a harmless temporary file inside the repository.

4. Prepare, but do not execute, a git push.

5. Attempt to contact a domain that is not in the sandbox or Auto Mode environment.

Observe the result. The first three should complete without routine prompts when they fit the active rules. The push should prompt because of permissions.ask. The unknown destination should not be silently trusted.

Why Claude Code Still Prompts

The autoMode block is in the repository

Move it from .claude/settings.json or .claude/settings.local.json to ~/.claude/settings.json, managed settings, or a trusted --settings input. Since version 2.1.207, project-local Auto Mode configuration is ignored.

An explicit ask rule matches

This is expected behavior. Content-scoped permissions.ask rules run before the classifier and always prompt when they match. Remove the rule only if you no longer want that checkpoint.

The destination is outside the trusted environment

By default, the classifier trusts the working directory and the current repository's configured remotes. Add a precise destination to autoMode.environment, then run claude auto-mode config again. Entries are plain-language descriptions, not regular expressions.

You replaced the built-in rules

Setting environment, allow, soft_deny, or hard_deny without "$defaults" replaces that section's built-in list. Add "$defaults" unless you deliberately copied and accepted responsibility for every rule in the section.

The command needs to leave the sandbox

Sandbox auto-allow applies only when a command can run inside the configured filesystem and network restrictions. Adjust the sandbox boundary only for a destination you trust. Do not enable unsandboxed execution merely to silence the prompt.

You chose dontAsk, not Auto Mode

dontAsk automatically denies actions that are not already allowed. It does not classify routine actions and approve them. Use it for a non-interactive fail-closed workflow, not as a replacement for Auto Mode.

A hook, connector, or MCP server requires interaction

An explicit permission hook, connector approval, or MCP requiresUserInteraction response can still require a person. Auto Mode does not erase an integration's own authorization boundary.

Keep Durable Boundaries Outside the Prompt

Telling Claude "never push" in conversation is useful context, but the instruction can disappear after context compaction. Put durable checkpoints in permissions.ask and hard prohibitions in permissions.deny.

A practical split is:

• use ask for pushes, pull requests, deployments, payments, external messages, and production changes;

• use deny for secret files, destructive infrastructure operations, and destinations that must never be reached;

• use Auto Mode for context-sensitive decisions inside the remaining space;

• use the sandbox to restrict what automatically approved shell commands can touch.

Avoid a growing collection of overlapping Bash allow rules. Start from the effective configuration and add the smallest boundary that explains a repeated denial.

Extend the Same Boundary to External APIs

Local permission settings do not protect a provider key pasted into a prompt or shell command. For GitHub, Gmail, Notion, or another external service, give the agent a named, scoped operation while the credential stays behind OAuth or a vault.

If the aident command is not installed, tell your coding agent: Follow https://aident.ai/SETUP.md.

Then ask the agent:

Search Aident for a read-only GitHub Action, inspect its schema, and execute it only after showing the exact repository and inputs. Do not request or print a provider credential.

This adds a second reproducible test: Claude Code decides whether the local tool call may run, while Aident exposes only the reviewed external operation and handles the provider connection outside the prompt.

A 20-Minute Success Check

The configuration works when all four observations are true:

1. Two routine repository commands complete without permission prompts.

2. git push still produces the checkpoint you configured.

3. An unknown network destination is blocked or reviewed.

4. One read-only external Action succeeds without a provider key appearing in the prompt, command input, output, or Git diff.

If a step fails, use /permissions and its Recently denied tab to inspect the exact call. Retry a one-off intended action from there, or add the missing trusted destination when it will be needed repeatedly.

Ready to test the external half of the boundary? Connect one read-only tool with Aident Loadout, inspect its Action schema, and verify one credential-free execution.

Sources

• Anthropic: Auto Mode configuration

• Anthropic: Claude Code permissions

• Anthropic: Claude Code sandboxing

• Anthropic: Claude Code settings

• Anthropic: Claude Code security

• Aident: MCP API Keys vs OAuth

• Aident: Audit an Agent Skill Before Installing It

Review this article after a material change to Claude Code permission modes, Auto Mode configuration scopes, classifier precedence, Bash sandbox behavior, or the Aident Loadout setup and Action execution flow.