Under the hood
Deny rules can now be bypassed for certain flagged tools when in auto mode or sandboxed plan mode
What
Claude Code's core permission check now has a narrow exception to its hard "deny" outcomes. A tool call that would normally be denied outright can instead fall through to further evaluation, but only when all of these are true:
- the tool is one whose classifier marks it as "flag on block" rather than a hard block
- the session is in auto mode, or in plan mode with sandboxing active
- no explicit deny rule for it exists once always-deny rules from user, project, local, and session settings are excluded
Why
This lets tools that are only meant to be flagged (not hard-blocked) avoid being denied outright in auto or sandboxed-plan sessions, as long as no explicit deny rule actually applies to them.