How Does Claude Code Auto Mode Check Permissions?

Thariq Shihipar says Claude Code auto mode checks whether an agent is acting inside the permission the user gave, while probes judge whether the intent itself is bad. A failure in any one security layer can let an agent escape the sandbox. Model training sits underneath probes and classifiers. Auto mode is another classifier on the requests being made, and identity and permissions sit beyond that.

A run of 10 minutes on full access or auto mode once looked manageable. Agents now run for hours, and fallbacks are still required. Models can wipe sensitive data. A scoped key for a production database is not enough, because the model can use computer use to issue its own key, copy the key over, and edit the database to finish the task. Probes judge intent, such as hacking an artifactory. Auto mode judges whether the action matches the permission the user gave. Sometimes a database write is allowed, and a probe should not block it.

As models get more intelligent, new false positives appear, and Anthropic is working to reduce them. The stack is how they deploy a model without a perfect sandbox and without saving everything.