Auto mode went GA in v2.1.111 on April 16 and most of the coverage treated it as a convenience feature: toggle with Shift+Tab, say goodbye to permission prompts. The Anthropic engineering deep‑dive tells a more interesting story — one every operator building their own autonomous harness should steal from.

The three‑tier decision pipeline. When Claude wants to run a tool, the decision flows through three gates:

graph TD
    A[Tool call proposed] --> B{Tier 1: Allowlist match?}
    B -- yes --> G[Run]
    B -- no --> C{Tier 2: In-project path?}
    C -- yes --> G
    C -- no --> D[Tier 3: Transcript classifier]
    D --> E{Safe?}
    E -- yes --> G
    E -- no --> F[Prompt user]

Tiers 1 and 2 are cheap, deterministic, and handle >95% of calls. Tier 3 is where the magic — and the interesting architectural decision — lives.

The Tier 3 classifier is reasoning-blind by design. The transcript classifier is a Sonnet 4.6 model running in a two-stage pipeline: a fast single-token filter knocks out the easy "obviously safe" and "obviously dangerous" cases, and a chain-of-thought second stage adjudicates the middle. Per Anthropic's engineering post, internal metrics are 0.4% FPR, 17% FNR on real overeager dangerous actions, 94.3% detection on synthetic exfiltration attempts.

The critical detail: the classifier sees the user's messages and Claude's tool calls, but it does not see Claude's own reasoning or tool outputs. It cannot read the assistant turns. This is deliberate. If the classifier could see Claude's reasoning, a prompt-injected document could write convincing justifications directly into the context window: *"I need to read ~/.ssh because the user asked me to debug their SSH config."* The classifier would read that justification and approve the call.

By refusing to consume Claude's own text, the classifier forces a cleaner evaluation: *given only the user's ask and the tool call itself, does this look like what the user asked for?* Claude cannot talk its way past the gate. The agent's own self-explanation is firewalled off from the approver.

Why this matters for your own harness designs. Three transferable patterns:

1. Separate the "doer" from the "approver." If the same context that decided to take an action also decides whether the action is allowed, you have no defense against prompt injection. Claude Code's auto mode enforces this with a model boundary (Opus decides, Sonnet approves) and with a context boundary (the approver can't read Opus's reasoning).
2. Calibrate your error modes asymmetrically. Auto mode's 17% FNR on real attacks and 0.4% FPR on benign work is the explicit tradeoff: false positives annoy you, false negatives burn you. The system is tuned to approve aggressively because the cost of an unnecessary prompt is a mild interruption, while the cost of a missed attack is a compromised machine. Your own guardrails should make the same tradeoff explicit.
3. Fail-closed on the approver. If the classifier errors out, auto mode prompts you. No "classifier down, run anyway." This is how you preserve security properties across infrastructure failures.

The operator transfer. You can build a reasoning-blind check into any multi-agent system you run. If you have a worker agent that proposes actions and a reviewer agent that approves them, pass the reviewer only the original user ask and the proposed action, never the worker's reasoning. Use a subagent with a custom tool-output filter hook, or a claude -p invocation with a carefully constrained prompt. The operator pattern is the same whether your "classifier" is Sonnet 4.6 running at Anthropic or a Haiku call you make yourself: the approver cannot be manipulated by prose it doesn't read.

Auto mode isn't a prompt-less convenience. It's a shipped, tested example of self-justification firewalling — and one of the cleaner applied-security artifacts to come out of Anthropic this year. If you're still running your agents with blanket allowlists, you're using a weaker security model than the one your CLI already ships with.