On Pro, Max and Team plans, auto mode is now the mode a session starts in. If your mental model is still "Claude asks before it does things", it is out of date -- and some of the rules you rely on do not apply in the mode you are now in by default.
Auto mode replaces your approval with a second model, a classifier, that reviews actions before they run. Read-only work and edits inside your working directory are approved without review. Shell commands and network calls go to the classifier. It is a real safety layer -- and it is a different layer from the one most people think they configured.
This is the part that surprises people. On entering auto mode, allow rules that grant arbitrary code execution are removed, and restored when you leave. That includes:
python* style patternsNarrow rules survive. An allow rule naming one exact command still applies. So the practical consequence is the opposite of what people assume: a carefully narrow allow list keeps working, and a convenient broad one silently stops. If your unattended runs depend on a broad rule, they are now going through the classifier instead.
A subagent's own permission setting is ignored. In auto mode, any permission mode declared in a subagent's own definition does not apply -- it runs under the parent's rules, and its final report is reviewed before the parent reads it. A security warning on a subagent's report is a verdict, not noise.
The classifier costs tokens and runs on its own model. It does not use your model selection, and on API and Enterprise accounts its calls count toward usage. Reads and working-directory edits skip it, so the cost sits on shell commands and network operations.
Allow rules only ever grant. The classifier is a model. Underneath both, deny rules block before either is consulted -- and that is the only floor in the system that does not involve anything forming an opinion.
The cleanest argument for using them is not about the agent at all: an ask rule leaves the decision to your future tired self at the worst possible moment. A deny rule takes the option away in advance. Anything you would not want to be asked about at the end of a long session belongs in deny, not ask.
One trap: deny rules match the command as written. A rule anchored to the start of a command misses the same command with an option in front of it. Walk the two or three ways the thing could actually be done -- the tool, the shell equivalent, the script that wraps it -- and check each one is covered.
A permission control here has repeatedly failed open while continuing to look like it worked -- the error text appeared, the user saw a block, the action ran anyway. Each case was reported and fixed within days, which is the reassuring half. The unreassuring half is that they shipped in releases and were found by users, not by the people relying on them.
So prove it once. In a scratch repository, ask for the exact thing your rule should stop, then check the world rather than the message -- did the file change, did the branch move, did the request leave. A control you have never seen refuse something is a control you are assuming. Re-run that probe after every upgrade.
The skills are plain SKILL.md markdown -- no install, no runtime, no dependency. Drop a folder into ~/.claude/skills/ and invoke it by name.
Four of them are free and need no signup: github.com/resilientmindset01-commits/claude-code-skills-free
Written by ResilientMindset. Not affiliated with, endorsed by, or sponsored by Anthropic. Every claim about Claude Code on this page was checked against Anthropic's own documentation on the date shown.