{"version":"2.1.323","anchor":"auto-mode-server-classifier-stale-context-direct-api-and-r","canonical_anchor":"auto-mode-server-classifier-stale-context-direct-api-and-r","heading":"Auto mode keeps approvals for sandboxed runs separate from session permissions","tier":"notice","area":"Auto Mode","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323\/e\/auto-mode-server-classifier-stale-context-direct-api-and-r","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323","markdown":"### Auto mode keeps approvals for sandboxed runs separate from session permissions\n\nIn auto mode, standing approvals given for sandboxed runs are now kept apart from the session's own permission rules\n\n**Unclear.** It is not clear what turns on the separate handling for sandboxed runs, so it may not apply to every auto mode session.\n\n**What**\n\nAuto mode lets Claude Code decide on many actions by itself, using a classifier, a check that judges whether an action is allowed. Two things about it have changed:\n\n- Standing approvals given for sandboxed runs are now tracked separately. Before, they were added to the session's own permission rules. A sandboxed run is one held inside the protective boundary that limits which files a program can touch.\n\n- The \"no allowed model\" outcome, which already applied when `CLAUDE_CODE_USER_DELEGATED_SESSION_DIRECT_API` is set, can now also be reached through another check.\n\n**Why**\n\nApprovals given for sandboxed auto mode runs no longer mix with the permission rules of the wider session, which changes how those approvals carry forward.\n\n- Area: Auto Mode\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: no"}