The 3 Safety Rails for Claude Code Auto Mode — the exact settings.json to paste before auto mode becomes your default

The companion to the video. On August 14, 2026, auto mode becomes the DEFAULT permission mode in Claude Code for Pro, Max, and Team — Claude stops asking before it runs commands. This is the copy-paste config that lets it fly and still can't touch what matters, plus the reasoning behind every line. INSIDE: (1) THE COMPLETE settings.json — all three rails in one block, ready to paste into ~/.claude/settings.json. (2) RAIL 1 — PICK YOUR POSTURE: set defaultMode yourself so Thursday's flip is your decision (auto / acceptEdits / plan), and the gotcha that 'auto' is only honored from your USER settings — a cloned repo can't promote itself. (3) RAIL 2 — DENY THE IRREVERSIBLE: a starter deny list (force-push, rm -rf, git reset --hard, and more) that holds in EVERY mode, even auto and bypass, with no classifier judgment involved — a hard wall. (4) RAIL 3 — GATE THE RISKY: an ask list (push, PR merge, terraform apply, prod deploys) that keeps auto's uninterrupted flow but forces a human checkpoint on the few actions you always want eyes on. (5) THE REAL RECEIPTS: the same 'rm app.js' run in real headless auto mode (v2.1.226, claude-sonnet-5) three ways — no rail deletes the file with no prompt; the deny rule returns 'Permission to use Bash with command rm app.js has been denied' and the file survives; the ask rule returns 'Claude requested permissions to use Bash, but you haven't granted it yet' and the file survives. (6) THE THURSDAY SURPRISE: auto mode silently DROPS your broad allow rules (Bash(*), wildcard interpreters, package-manager run commands, Agent rules) and hands them to the classifier — so your old guardrails don't come with you. (7) WHY RAILS BEAT TRUST: Anthropic's own line, 'auto mode reduces permission prompts but does not guarantee safety,' and the documented fact that a boundary you only SAY out loud can be forgotten when your context is compacted — which is why a deny rule is the only hard guarantee. Honest limits stated: tested headless on one machine, one day; deny/ask rules are deterministic, the classifier is probabilistic. Independent guide from Hyperautomation Labs — not affiliated with Anthropic.

By submitting, you'll be subscribed to the Hyperautomation AI Report newsletter — one practical AI email per week. Unsubscribe anytime.

Free. No spam. Unsubscribe anytime.