Claude Code auto mode rules: write your own in one plain sentence

The classifier that decides what runs reads prose, not patterns. You can hand it a rule of your own, written the way you would explain it to someone joining the team today. And there is a nine-character token you cannot forget to include.

One sentence of yours in autoMode.soft_deny: with $defaults you get 69 active rules, without the token just 1

TL;DR Create autoMode.soft_deny in ~/.claude/settings.json with "$defaults" first and your sentence under it, then check the result with claude auto-mode config. If the list drops from 68 rules to 1, you just deleted the built-in protections.

Auto mode routes every tool call through a classifier before it runs. That classifier doesn't match patterns like Bash(git push *). It reads prose. Its rules are plain English sentences, and you can read all of them with claude auto-mode defaults.

Yours go right next to them. You write a rule the way you'd explain it to someone joining the team today, and the classifier enforces it the same way it enforces its own. No regex, no command lists.

There are four lists under autoMode, and each one sits at a different tier of precedence:

hard_deny   always blocks. Neither your intent nor an allow clears it.
soft_deny   blocks, but opens if you ask for the exact action.
allow       exceptions that override a soft_deny.
environment what the classifier treats as inside your perimeter.

1. Write the rule

{
  "autoMode": {
    "soft_deny": [
      "$defaults",
      "Never run database migrations outside the migrations CLI"
    ],
    "hard_deny": [
      "$defaults",
      "Never send repository contents to third-party code-review APIs"
    ]
  }
}

That file has to be ~/.claude/settings.json. The classifier doesn't read autoMode from the project's .claude/settings.json, and since v2.1.207 not from settings.local.json either. Both live inside the repository, so a repo you clone or a build step could otherwise grant itself its own rules. Your only other options are your organization's managed settings or the --settings flag.

2. Check that you didn't wipe anything

This is the expensive part. "$defaults" splices the built-in rules in at whatever position you put it. Leave it out and your list replaces the entire built-in list for that section, with no warning.

claude auto-mode config | jq 'map_values(length)'

With "$defaults" in both lists, my two sentences are added to what was already there:

{ "allow": 17, "soft_deny": 69, "hard_deny": 2, "environment": 20 }

Drop "$defaults" from soft_deny and the only rule left is mine. All 68 built-ins are gone:

{ "allow": 17, "soft_deny": 1, "hard_deny": 1, "environment": 20 }

Those 68 are where force push lives, along with curl | bash, production deploys, and the block on attempts to bypass auto mode itself. You're still in auto mode, still looking at the bolt in your status line, and it's protecting you from almost nothing.

3. Get a critique before you trust it

claude auto-mode critique

A model reads your rules back and tells you where they're ambiguous, redundant, or headed for false positives. On my migrations rule:

## soft_deny: "Never run database migrations outside the migrations CLI"

Biggest problem: the CLI is never named. The classifier has no way to know
whether "the migrations CLI" means alembic upgrade, prisma migrate deploy,
rails db:migrate, dbmate, or ./bin/migrate.

No environment scoping. Running raw DDL against localhost:5432/myapp_dev is
normal development; blocking it will generate constant false positives.

And on the hard_deny one, a warning I hadn't seen coming: GitHub is a code-review service, so a literal reading puts gh pr create and git push inside my own rule. Being hard_deny, no message of mine would clear it afterwards. Its fix is to exempt the repository's own configured remote by name.

Reference

List	What goes in it	What clears it
`hard_deny`	non-negotiable security boundaries	nothing
`soft_deny`	destructive actions you sometimes do want	your explicit intent, or an `allow`
`allow`	exceptions to a `soft_deny`	(doesn't block)
`environment`	trusted repos, buckets and domains	(doesn't block)

environment entries are the fix for repeated blocks against the same destination. To have Claude Code draft them by reading your project and your recent sessions in it, /auto-mode-setup proposes and writes them (v2.1.228). And as of v2.1.246, /permissions has an Auto mode tab where you edit the same lists without opening the JSON, with "$defaults" inserted for you.

If you want out of all of it, claude auto-mode reset removes your autoMode section and puts the defaults back (v2.1.212).

Requirements

Auto mode available on your account. claude auto-mode critique and config work wherever the subcommand exists; --label needs v2.1.208, reset v2.1.212, /auto-mode-setup v2.1.228, and the /permissions tab v2.1.246.

New to auto mode? Start with Escape Claude Code's permission fatigue without going YOLO. For what it blocks out of the box, see Claude Code auto mode now protects you from yourself.

Official docs: Configure auto mode | Permission modes