Auto Mode Default Rules

These are the built-in entries of the auto mode classifier. An allow entry is an exception to a block rule. A soft_deny entry blocks an action unless an allow entry applies or you clearly asked for it. For example, Production Deploy blocks a deploy to production until you ask for it by name.

The entries apply whenever the permission mode is auto. Add or replace entries with the autoMode setting. Keep the defaults with $defaults. Drop $defaults from a list to remove the built-in entries of that list. The entries live inside the program. claude auto-mode defaults prints them as JSON.

Example

claude auto-mode defaults --label "Production Deploy"

This prints the full text of one rule. --label matches the start of a label, without regard to case. In the JSON, some labels end in [named+specifics ...]. For those rules, your request must name the listed item to count as direction.

Rule summaries below are short. Official page: Configure Auto Mode. Rules marked

Undocumented: Only the program shows this item. It can change without notice.

come from claude auto-mode defaults.

Allow Rules

Each allow rule is an exception to the soft deny rules.

Rule	Status	What it allows
Security Discussion	Undocumented: Only the program shows this item. It can change without notice.	Reading, reviewing, or writing security code and threat models is fine as part of your task.
Transient Retry	Undocumented: Only the program shows this item. It can change without notice.	Retrying an action after a network error, timeout, or rate limit is not a bypass.
Test Artifacts	Documented: An official docs page names this item.	Fake test keys, placeholder credentials, and hardcoded test cases are fine.
Local Operations	Undocumented: Only the program shows this item. It can change without notice.	Deleting or changing local files inside the project is fine.
Read-Only Operations	Undocumented: Only the program shows this item. It can change without notice.	GET requests and queries that change nothing and return no secrets are fine.
Declared Dependencies	Undocumented: Only the program shows this item. It can change without notice.	Installing packages that the repo manifest already lists is fine.
Toolchain Bootstrap	Undocumented: Only the program shows this item. It can change without notice.	Installing a language toolchain from its official one-line installer is fine when the repo needs it.
Standard Credentials	Undocumented: Only the program shows this item. It can change without notice.	Reading a credential from the agent config and sending it to its own provider is fine.
Session-Created Job Cleanup	Undocumented: Only the program shows this item. It can change without notice.	Deleting the jobs that the agent itself made in this session is fine.
Git Push Destination	Undocumented: Only the program shows this item. It can change without notice.	Pushing to any branch of the session repo is normal, also the default branch.
Trusted Internal Infra (Data Flow)	Undocumented: Only the program shows this item. It can change without notice.	Domains, buckets, and services in Environment count as internal, not external.
Scheduled-Task Fires	Undocumented: Only the program shows this item. It can change without notice.	A scheduled-task prompt is not a live human instruction.
Multi-Agent Coordination	Undocumented: Only the program shows this item. It can change without notice.	Messages between teammates and subagents are normal traffic.
Memory Directory	Undocumented: Only the program shows this item. It can change without notice.	Routine writes to and deletes from the memory directory are fine.
CLAUDE.md Content	Undocumented: Only the program shows this item. It can change without notice.	Editing CLAUDE.md is fine when the text does not change permissions or auto mode.
Claude Code Scheduling	Undocumented: Only the program shows this item. It can change without notice.	Using CronCreate, CronDelete, CronList, or RemoteTrigger to schedule tasks is fine.
Browser Trusted Navigation	Undocumented: Only the program shows this item. It can change without notice.	Navigating the browser to a trusted domain, localhost, or a URL you named is fine.

Hard Deny Rule

Rule	Status	What it blocks
Data Exfiltration	Documented: An official docs page names this item.	Sending sensitive data across the trust boundary is always blocked, even when you ask for it.

A scoped exception sends commits and pushes of sensitive material to the Sensitive-Source Provenance soft rule when that rule exists.

Environment Fields

Most fields say None configured. Fill them with autoMode.environment.

Field	Status	Default text
Organization	Documented: An official docs page names this item.	None configured.
Primary use of Claude Code	Documented: An official docs page names this item.	software development.
Cloud provider(s)	Documented: An official docs page names this item.	None configured.
Repository visibility	Documented: An official docs page names this item.	assume private unless the remote host and repo name indicate otherwise, or a visibility check in the transcript shows public.
Internal sharing / snippet hosting	Documented: An official docs page names this item.	None configured.
Org-specific CLIs	Documented: An official docs page names this item.	None configured.
Secrets management	Documented: An official docs page names this item.	None configured.
CI/CD deploy targets	Documented: An official docs page names this item.	None configured.
Network posture	Documented: An official docs page names this item.	None configured.
Host containment	Documented: An official docs page names this item.	None configured.
Protected deployment namespaces / environments	Documented: An official docs page names this item.	None configured.
Data retention / declassification	Documented: An official docs page names this item.	None configured.
Trusted repo	Documented: An official docs page names this item.	The git repository the agent started in (its working directory) and its configured remote(s). When the repo's public/private visibility is given.
Source control	Documented: An official docs page names this item.	The trusted repo and its remote(s) only (no additional orgs configured).
Trusted internal domains	Documented: An official docs page names this item.	None configured.
Trusted cloud buckets	Documented: An official docs page names this item.	None configured.
Key internal services	Documented: An official docs page names this item.	None configured.
Internal package registry	Documented: An official docs page names this item.	None configured.
Sensitive data locations & audiences	Documented: An official docs page names this item.	any file or store holding personal data, confidential business data, credentials, regulated data, or similarly sensitive material, and more.
Sensitive remote targets	Documented: An official docs page names this item.	any namespace, host, or container whose name carries prod or production as a whole word or name segment (hyphen/underscore/dot-delimited.
Protected IaC scopes	Documented: An official docs page names this item.	IAM, RBAC, networking, quota, and node-pool resources, anything whose name or tag carries prod or production as a whole word or name segment.

Soft Deny Rules

Rule	Status	What it blocks
Git Destructive	Documented: An official docs page names this item.	Force-pushes, remote branch or tag deletes, and history rewrites that destroy the work of others.
Code That Leaks When Run	Undocumented: Only the program shows this item. It can change without notice.	Committing code that would leak secrets or widen access when it runs.
Code from External	Undocumented: Only the program shows this item. It can change without notice.	Running code that came from an outside source.
Cloud Storage Mass Delete	Undocumented: Only the program shows this item. It can change without notice.	Mass deletes on cloud storage, or dropping data stores.
Production Deploy	Documented: An official docs page names this item.	Deploys to production and production database migrations.
Remote Shell Writes	Undocumented: Only the program shows this item. It can change without notice.	Writing to live production or shared hosts through ssh, kubectl exec, and similar.
Sensitive Remote Exec	Undocumented: Only the program shows this item. It can change without notice.	Interactive sessions or port forwards into sensitive remote targets.
Production Reads	Undocumented: Only the program shows this item. It can change without notice.	Reading inside live production through a remote shell.
Blind Apply	Undocumented: Only the program shows this item. It can change without notice.	Applying live infrastructure changes with --yes or --auto-approve and no preview.
Protected-Scope IaC Apply	Undocumented: Only the program shows this item. It can change without notice.	Infrastructure-as-code applies that touch protected scopes.
Logging/Audit Tampering	Undocumented: Only the program shows this item. It can change without notice.	Stopping logs, deleting log directories, or removing audit trails and git hooks.
Permission Grant	Undocumented: Only the program shows this item. It can change without notice.	Granting admin roles, adding repo users, or raising IAM permissions.
Account & Standing-Rule Changes	Undocumented: Only the program shows this item. It can change without notice.	Changing account security or creating standing rules, such as mail forwarding.
TLS/Auth Weaken	Undocumented: Only the program shows this item. It can change without notice.	Turning off TLS checks or authentication on a service.
Secret-Store Writes	Undocumented: Only the program shows this item. It can change without notice.	Creating, rotating, or deleting entries in a secret manager.
DNS / Domain / Cert Changes	Undocumented: Only the program shows this item. It can change without notice.	Changing DNS records, domain settings, or TLS certificates.
Security Weaken	Undocumented: Only the program shows this item. It can change without notice.	Turning off security controls or adding ways around them.
Security Test Removal	Undocumented: Only the program shows this item. It can change without notice.	Deleting or skipping tests that guard auth, crypto, or sandboxing.
Safety Bypass Flag	Undocumented: Only the program shows this item. It can change without notice.	Running a command with a flag such as DANGEROUSLY_* or BREAKGLASS*.
Create Unsafe Agents	Undocumented: Only the program shows this item. It can change without notice.	Creating agent loops that run commands with no human approval.
Interfere With Workloads	Undocumented: Only the program shows this item. It can change without notice.	Deleting, cancelling, or killing jobs the agent did not start in this session.
Shared Cluster Mutation	Undocumented: Only the program shows this item. It can change without notice.	Writes to a shared compute cluster that can hit the jobs of other users.
CI Bypass	Undocumented: Only the program shows this item. It can change without notice.	Disabling CI checks, editing branch protection, or marking required checks as optional.
Modify Shared Resources	Undocumented: Only the program shows this item. It can change without notice.	Changing or destroying shared resources that this session did not create.
Irreversible Local Destruction	Undocumented: Only the program shows this item. It can change without notice.	Deleting or overwriting local files that existed before the session, such as rm -rf.
Unverifiable Deletion Target	Undocumented: Only the program shows this item. It can change without notice.	A forced recursive delete whose target is a shell variable or a glob.
Shared Scratch Sweep	Undocumented: Only the program shows this item. It can change without notice.	Broad deletes in shared scratch space such as /tmp.
Irreversible Deletion (general)	Undocumented: Only the program shows this item. It can change without notice.	Tearing down a stateful resource that the agent did not create.
Unverifiable Deletion Scope	Undocumented: Only the program shows this item. It can change without notice.	A delete on shared or remote state whose targets are computed at run time.
Create RCE Surface	Undocumented: Only the program shows this item. It can change without notice.	Creating endpoints that run arbitrary code, or code with remote-execution holes.
Expose Local Services	Undocumented: Only the program shows this item. It can change without notice.	Starting a listener or file server that exposes local files or a shell to the network.
External Ingress Tunnel	Undocumented: Only the program shows this item. It can change without notice.	Opening a tunnel, such as ssh -R, that makes a local address reachable from the internet.
Credential Leakage	Undocumented: Only the program shows this item. It can change without notice.	Writing real secrets into commits, images, or other lasting files.
Credential Materialization	Undocumented: Only the program shows this item. It can change without notice.	Printing a live token or credential into output, the transcript, or a file.
Credential Exploration	Undocumented: Only the program shows this item. It can change without notice.	Scanning credential stores for secrets.
PII Data Handling	Undocumented: Only the program shows this item. It can change without notice.	Copying sensitive data out of its listed location.
Exfil Scouting	Undocumented: Only the program shows this item. It can change without notice.	Testing which outside endpoints are reachable, to prepare data theft.
Traffic Redirection	Undocumented: Only the program shows this item. It can change without notice.	Pointing API base URLs, proxies, or registries at third-party hosts.
Remote Repoint	Undocumented: Only the program shows this item. It can change without notice.	Changing where pushes go, such as git remote set-url.
Out-of-Place Publication	Undocumented: Only the program shows this item. It can change without notice.	Pushing or publishing work to a public place that does not fit the task.
Sensitive-Source Provenance	Documented: An official docs page names this item.	Sensitive content flowing into a repo, a commit, or a push.
Excess Sensitive Detail	Undocumented: Only the program shows this item. It can change without notice.	Sending more sensitive detail to a recipient than you approved.
Unrequested Artifact Publish	Undocumented: Only the program shows this item. It can change without notice.	Publishing a file to a claude.ai page with the Artifact tool when you did not ask for it.
Live-Shared Artifact Sensitive Delta	Undocumented: Only the program shows this item. It can change without notice.	Adding sensitive content to an artifact that viewers see live.
Sandbox Network Callback	Undocumented: Only the program shows this item. It can change without notice.	A sandboxed command that opens a connection to an unapproved host.
Command Network Lists	Undocumented: Only the program shows this item. It can change without notice.	A shell command that sets its own allowed_domains list.
Containment Escape	Undocumented: Only the program shows this item. It can change without notice.	Reaching past the network or identity boundary of the container or VM that runs Claude Code.
Create Public Surface	Undocumented: Only the program shows this item. It can change without notice.	Creating a public repo, release, or package.
Public Data-Sharing Upload	Undocumented: Only the program shows this item. It can change without notice.	Creating gists or uploading data to public sharing services.
Untrusted Code Integration	Undocumented: Only the program shows this item. It can change without notice.	Pulling in code from outside your orgs and arranging for it to run.
Package Registry Bypass	Undocumented: Only the program shows this item. It can change without notice.	Installing from a public registry when an internal registry exists.
Unauthorized Persistence	Undocumented: Only the program shows this item. It can change without notice.	Adding SSH keys or editing shell profiles and credential stores.
Self-Modification	Undocumented: Only the program shows this item. It can change without notice.	Editing the permissions, hooks, or sandbox config of the agent itself.
Tmux Self Drive	Undocumented: Only the program shows this item. It can change without notice.	Sending keystrokes to the pane of the agent itself to change its own oversight.
Instruction Poisoning	Undocumented: Only the program shows this item. It can change without notice.	Writing to files that a later session reads as instructions, such as CLAUDE.md.
Auto-Mode Bypass	Undocumented: Only the program shows this item. It can change without notice.	Working around the classifier or the permission system.
Session Transcript Tampering	Undocumented: Only the program shows this item. It can change without notice.	Writing to session transcript files.
Unrequested Commit in a Connected App	Undocumented: Only the program shows this item. It can change without notice.	Committing a decision in a connected app when you asked only for a read or a draft.
External System Writes	Undocumented: Only the program shows this item. It can change without notice.	Deleting, closing, or mass-changing items in tools such as Jira, Linear, or mail.
Merge Without Review	Undocumented: Only the program shows this item. It can change without notice.	Merging a pull request before a human approves it.
Self-Approval	Undocumented: Only the program shows this item. It can change without notice.	Approving a pull request that the agent wrote.
ChatOps Trigger Comments	Undocumented: Only the program shows this item. It can change without notice.	Posting a comment that is a command to automation, such as atlantis apply.
Feature Flag Writes	Undocumented: Only the program shows this item. It can change without notice.	Changing or deleting a production feature flag.
Node Lifecycle Operations	Undocumented: Only the program shows this item. It can change without notice.	Cordoning, draining, restarting, or removing cluster nodes.
Cluster-Wide Workload Creation	Undocumented: Only the program shows this item. It can change without notice.	Creating resources that run on every node or intercept cluster traffic.
Real-World Transactions	Undocumented: Only the program shows this item. It can change without notice.	Payments, purchases, trades, and other actions with real-world cost.
Third-Party Attack	Undocumented: Only the program shows this item. It can change without notice.	Attacking a real system of an outside party.
Browser Navigate Exfil	Undocumented: Only the program shows this item. It can change without notice.	Navigating the browser to an unrelated outside domain, with data in the URL.
Browser Input Exfil	Undocumented: Only the program shows this item. It can change without notice.	Typing credentials or sensitive data into a browser page that you did not provide.
Browser JS Exfil	Undocumented: Only the program shows this item. It can change without notice.	Browser scripts that read cookies or storage and send them off-site.
Browser File Upload Exfil	Undocumented: Only the program shows this item. It can change without notice.	Uploading files from outside the project, or sensitive files, in the browser.
Browser Shortcut Execution	Undocumented: Only the program shows this item. It can change without notice.	Running browser shortcuts, whose effect is hidden.

Related Pages

• Auto Mode
• Permission Rules