Claude Code Auto Mode for Client Work: What It Actually Approves Without Asking You
- Auto Mode replaces most permission prompts with a classifier model (Sonnet 5 by default) that decides yes or no on your behalf, following a fixed order: explicit deny and ask rules first, then read-only actions and edits inside the working directory get auto-approved, then everything else goes to the classifier.
- Two things override the classifier completely and always win: permission deny rules in settings.json, and PreToolUse hooks that exit with code 2. A boundary you only stated in conversation is not in that list, and can be lost the moment the session compacts.
- The Deny-First Rule: write your hard boundaries as deny rules and hooks before you ever turn Auto Mode on against a client's repository. Anything you have not written down that way is a suggestion to the classifier, not a rule.
What Auto Mode Actually Is
Auto Mode is a built-in starting permission mode available on Pro, Max, and Team plans as of Claude Code v2.1.228 on macOS, Linux, and WSL, and v2.1.233 on Windows. Instead of Claude Code pausing to ask you to approve each tool call, a separate classifier model, Sonnet 5 by default, reviews the action and decides whether to let it through. The point is fewer interruptions on a long agentic session; the tradeoff is that a decision which used to require your explicit yes now happens without you seeing it in the moment.
The Fixed Decision Order Auto Mode Follows
Every action Claude Code considers taking runs through the same fixed sequence, and knowing that order is the difference between trusting Auto Mode and guessing at it.
| Step | What happens | Can it be overridden? |
|---|---|---|
| 1. Explicit deny / ask rules | Rules you defined in settings.json are checked first, before anything else | This is the override layer; nothing below it can undo a deny |
| 2. PreToolUse hooks | A hook script runs and can block the action by exiting with code 2 | Also an override layer, independent of the classifier |
| 3. Read-only actions and working-directory edits | Auto-approved automatically once step 1 and 2 pass | Not sent to the classifier at all |
| 4. Everything else | Routed to the classifier model, which decides yes or no based on its own judgment | This is the layer that can get it wrong |
How Claude Code decides whether an action runs, in order
The part worth sitting with is that deny rules and PreToolUse hooks are not just early in this order, they are structurally outside the classifier's judgment entirely. The classifier only ever sees the actions that made it past both of those gates. If you never wrote the gate, there is nothing stopping the classifier from being the only thing standing between an action and a client's production system.
The Deny-First Rule
The Deny-First Rule is simple: write your hard boundaries as permission deny rules and PreToolUse hooks before you ever turn Auto Mode on against a client's repository, not after. This exists because of one specific failure mode: a boundary you only stated in the conversation, like telling Claude out loud not to touch the production database or the payments code, is context, and context is exactly what gets lost when a long session compacts. A deny rule in settings.json survives compaction. A sentence you typed forty turns ago does not.
In practice this means writing the boundary once, in the format Claude Code actually enforces, rather than relying on discipline to keep repeating it. That same instinct is why [Claude Code hooks for client work](/blog/claude-code-hooks-for-client-work) are worth setting up before your first Auto Mode session on a given client, not after something goes wrong.
What to Deny by Default on a Client Repo
The specific rules depend on the engagement, but a small set of categories are worth denying on nearly every client codebase before you switch Auto Mode on.
- Direct writes to migration or seed files that touch a production database, so a schema change always requires your explicit review.
- Any command that pushes to a protected branch or force-pushes anywhere, regardless of how routine the rest of the session has been.
- Reads or writes to files holding credentials, API keys, or `.env` contents that are not already scoped out of the working directory.
- Deploy or infrastructure commands (a deploy script, a cloud CLI call) that should stay a deliberate, reviewed step rather than a background approval.
What the Classifier Handles Well, and Where It Does Not
The classifier is genuinely useful for the volume of small, ambiguous, low-stakes calls that used to interrupt a session for no real reason: an ordinary file edit inside the project, a routine read of a config file, a test run. It is a model making a judgment call, not a hardcoded rule, which means it can misjudge an edge case the same way any model can. That is exactly why it should never be the only thing standing between an action and something that would be expensive or hard to reverse if it went wrong. Deny rules and hooks are for the actions where you are not willing to accept a model's best guess; the classifier is for everything else.
Common Mistakes Turning On Auto Mode Against Client Work
- Enabling Auto Mode on a client's repository with zero deny rules configured, relying entirely on the classifier's judgment for every action including the risky ones.
- Treating a boundary stated once in conversation as equivalent to a settings.json rule, then being surprised it did not hold after the session compacted.
- Copying the same deny list across every client without adjusting it for that client's specific stack, so a Rails app's dangerous commands are missing from a Next.js client's ruleset and vice versa.
- Never testing that a deny rule actually blocks the action it is meant to, and finding out it was misconfigured only after Auto Mode let something through.
Join the Profit Room
Inside the Claude Code Profit Room, builders share the actual deny rules and hook configs they run before switching Auto Mode on against a paying client's repository, not just the theory. Join us at https://www.skool.com/claudecodeprofitroom/about and bring the client repo you have not gated yet.
Short, practical drops on offers, outreach, pricing, and closing clients with Claude Code. No spam, unsubscribe anytime.
Frequently asked
Is Claude Code Auto Mode safe to use on a client's codebase?
It is safe once you have written explicit permission deny rules and PreToolUse hooks for anything you cannot accept a model's judgment call on, because those two things are the only layers checked before the classifier model ever sees an action. Without them, the classifier's best-guess judgment is the only thing standing between an action and your client's codebase.
What overrides the Auto Mode classifier?
Two things, and only two: permission deny/ask rules defined in settings.json, and PreToolUse hooks that exit with code 2. Both are checked before the classifier is ever consulted, and both survive context compaction. Nothing said in the conversation itself overrides the classifier.
Which model reviews actions in Auto Mode?
Sonnet 5 by default, acting as a separate classifier that decides whether to approve an action instead of prompting you directly. It is a model making a judgment call, not a fixed rule engine, which is why hard boundaries should be written as deny rules rather than left to its discretion.
Does telling Claude a boundary in the chat count as a permission rule?
No. A boundary only stated in conversation is context, and context can be lost when a long session compacts. Only settings.json deny/ask rules and PreToolUse hooks with an exit-code-2 block are structurally guaranteed to hold regardless of how the conversation evolves.
Last reviewed August 27, 2026.
Co-founder of the Claude Code Profit Room. Went from shipping software to closing paying clients, and now teaches builders the selling half of the equation.
More from David Iya →
