What is auto mode?
Per the official docs, Claude Code stops asking you about routine actions and instead routes tool calls through a classifier that blocks anything irreversible, destructive or aimed outside your environment. By default the classifier trusts only the working directory and the current repo's configured remotes, so pushing to your company's other organizations or writing to a team cloud bucket is blocked until you add it to autoMode.environment.
Why does it exist, and how does it differ from confirming every action or allowing everything?
Confirming every action trains people to click approve without reading, while bypass mode has no check at all. Auto mode is the middle path: a classifier makes the first judgment instead of a person. It is not a hard boundary, though. The docs say deny and explicit ask rules are evaluated before the classifier and still Block or prompt; the classifier is a second gate after the permissions system.
How does the classifier decide, and how do I tune it?
Inside the classifier there are four tiers: hard_deny blocks unconditionally; soft_deny blocks but user intent and allow exceptions can clear it; allow acts as an exception to soft rules; and a user message that directly describes the specific action can also clear it. Settings live in the autoMode Block (environment, allow, soft_deny, hard_deny) and are read only from ~/.claude/settings.json, managed settings and --settings, never from project settings. An array needs "$defaults" to keep the built-in rules; without it the array replaces them. Use claude auto-mode defaults, config, critique, reset and /auto-mode-setup to inspect and draft.
So what does this mean for me?
If you turn on auto mode: put your repo organizations, internal domains and cloud buckets into environment to cut false blocks; for things that must never happen use managed permissions.deny rather than classifier settings; the docs also say a developer-added allow can override an organization soft_deny, so organization-level hard rules belong in permissions.deny. I have not tested the classifier's accuracy, and the official page gives no false-Block or missed-block rates.
From the official docs: asking Claude to "clean up the repo" does not authorize a force push, but saying "force-push this branch" is explicit intent and the classifier allows it. Another: a push to a branch whose name marks it as a deploy target, such as production, release or gh-pages, is judged separately as a production deploy.
Pros: fewer routine prompts while keeping a layer of checking. Cons: environment facts the classifier cannot see must be written into settings, omissions cause false blocks, and leaving "$defaults" out of an array silently removes built-in rules.