Configure auto mode changedauto-mode-config
Nearest release: v2.1.322, published 15 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 10 Nov 2026 17:49 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 10 Nov 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+4added
Lines−4removed
From line
176
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits30to this page, all time
The whole hunk
from line 176, old and new numbered
/
from line 176
176176
177177Claude Code scans in the background, then shows you the draft. You accept or discard it as a whole, so edit `~/.claude/settings.json` afterwards to adjust single entries. When you accept, Claude Code writes the draft and reconciles it with the settings you already have:
178178
179* Claude Code writes the `environment` list without `"$defaults"`, because the draft spells out the built-in entries it left unchanged
179* If you chose to add to the `environment` list in `~/.claude/settings.json`, you keep any `"$defaults"` entry in it. If you chose to replace that list, you lose that entry, so add `"$defaults"` back if you want the default entries
180180* Claude Code includes `"$defaults"` in each of the `allow`, `soft_deny`, and `hard_deny` lists the draft adds entries to, unless you already wrote an `allow` list without it, so the [built-in rules](#override-the-block-and-allow-rules) you haven't replaced stay in effect
181181* After saving, Claude Code offers to remove `permissions.allow` rules in `~/.claude/settings.json` that auto mode ignores, such as `Bash(*)`, or that auto-approve destructive commands
182182
from line 212
212212
213213Three additional fields let you replace the classifier's built-in rule lists:
214214
215* `autoMode.hard_deny`: unconditional security boundaries
215* `autoMode.hard_deny`: actions to block even when the user asks for them
216216* `autoMode.soft_deny`: destructive actions that user intent can clear
217217* `autoMode.allow`: exceptions to soft block rules
218218
from line 227
227227
228228General requests don't count as explicit intent. Asking Claude to "clean up the repo" doesn't authorize force-pushing, but asking Claude to "force-push this branch" does.
229229
230To loosen, add to `allow` when the classifier repeatedly flags a routine pattern the default exceptions don't cover. To tighten, add to `soft_deny` for destructive risks specific to your environment that the defaults miss, or to `hard_deny` for security boundaries that must never be crossed.
230To loosen, add to `allow` when the classifier repeatedly flags a routine pattern the default exceptions don't cover. To tighten, add to `soft_deny` for destructive risks specific to your environment that the defaults miss, or to `hard_deny` for actions to block even when the user asks for them.
231231
232232To keep the built-in rules while adding your own, include the literal string `"$defaults"` in the array. The default rules are spliced in at that position, so your custom rules can go before or after them, and you continue to inherit updates as the built-in list changes across releases.
233233
from line 248
248248 "soft_deny": [
249249 "$defaults",
250250 "Never run database migrations outside the migrations CLI, even against dev databases",
251 "Never modify files under infra/terraform/prod/: production infrastructure changes go through the review workflow"
251 "Running terraform apply in infra/terraform/prod/ needs an explicit request: production infrastructure changes go through the review workflow"
252252 ],
253253 "hard_deny": [
254254 "$defaults",
No line in this hunk matches that.