# Claude Code Auto Mode Setup: Teach It Your Environment > Claude Code auto mode blocks what it doesn't know is yours. Since 19 Oct 2026, /auto-mode-setup works on more setups. What it does and what to check. 21 October 2026 · Plain English · What's new · 7 min read · https://bridge-terminal.com/atlas/blog/claude-code-auto-mode-setup-environment/ ## The short version - Claude Code's auto mode lets a second AI model, called the classifier, review actions instead of asking you each time. It blocks anything irreversible, destructive or aimed outside your environment. - By default the classifier trusts only the folder you are working in and that project's configured git remotes, so pushes to your company's other repositories or storage are blocked until you add them. - Claude Code 2.1.304, released 19 October 2026, made the guided /auto-mode-setup command work on Bedrock, Vertex, Foundry, Claude apps gateway and telemetry-disabled sessions. - The setup command drafts the trusted list for you, but you accept or discard the draft as a whole, so read it before saying yes. - Rules that must never be broken belong in deny rules, which are checked before the classifier and cannot be overridden. If your team uses Claude Code and keeps hitting "denied by auto mode" messages, the fix is now easier to reach. Claude Code version 2.1.304, released on 19 October 2026, made the guided `/auto-mode-setup` command available in more kinds of setup: Amazon Bedrock, Google Vertex, Microsoft Foundry, the Claude apps gateway, and sessions with telemetry turned off. The command teaches auto mode what your company's own systems are, so it stops blocking routine work. This article explains what auto mode is, what changed, and what a founder, product owner or tech lead should decide about it. ## What is auto mode in Claude Code? An AI coding agent does many small things: it edits files, runs commands and talks to the network. In the cautious default, called manual mode, it stops and asks before most of them. That is safe but slow, and people soon click "yes" without reading. In auto mode, a second model, called the classifier, reviews the actions instead of you. According to Anthropic's configuration documentation, it blocks anything irreversible, destructive, or aimed outside your environment. Everything else goes ahead without a prompt. Two details matter for non-engineers: - Auto mode is not the same as "allow everything". Your own deny rules (rules that say "never do this") and any "ask" rules (rules that say "always check with me first") are evaluated before the classifier and still block or prompt. - Per the permission-modes documentation, with Claude Code 2.1.283 or later, auto mode is the built-in starting mode for interactive terminal and VS Code sessions. So many people are already using it without choosing it. ## What changed on 19 October 2026? The release notes for version 2.1.304 (GitHub lists it as released on 19 October) describe `/auto-mode-setup` as "now also available on Bedrock, Vertex, Foundry, Claude apps gateway and telemetry-disabled sessions." The documentation explains the gap: before 2.1.304, the command was missing in sessions where Claude Code does not fetch feature flags, which is what happens with telemetry off, a third-party provider or the gateway. Many companies choose those setups for privacy or procurement reasons. The command itself is not brand new. The documentation lists earlier minimum versions: 2.1.228 or later on Pro, Max and Team plans, and 2.1.283 or later on Enterprise plans or with a Claude Console API key. What is new on this date is the reach. Two other recent changes touch auto mode: - Version 2.1.302 (16 October) added an environment variable, `CLAUDE_CODE_AUTO_MODE_MODEL`, to choose which model the client-side classifier uses. It also made the server-side classifier compact a conversation that is too long for the safety check, instead of denying every checked action. - Version 2.1.304 stopped storing the classifier's context with every request, which makes session files smaller. ## Why does auto mode block things that look normal? Because it does not know your company. According to the documentation, the classifier by default trusts only the folder you are working in and the current repository's configured remotes (the addresses it pushes code to). Anything else counts as outside. So these routine jobs can be blocked until you explain them: - Pushing code to another repository in your company's source-control organisation. - Writing to a shared cloud storage bucket your team owns. - Calling an internal service or dashboard. - Installing packages from your private package registry. The result is a pattern many teams know: the agent works well, then stalls on a perfectly normal step. Someone grants a broad permission to make it stop, and the safety net gets weaker than it should be. The documentation's advice is to tell the classifier about the destination rather than loosen everything. It says repeated denials for the same destination usually mean the classifier is missing context. ## What does /auto-mode-setup actually do? You type the command in an interactive terminal session. Claude Code then drafts a list of "environment entries". These are plain-English sentences saying, for example, which source-control organisation is yours, which storage buckets are trusted and which internal domains are safe. According to the documentation, it always reads: - Your project's instruction file (`CLAUDE.md`), README, config files and git remotes. - Your existing auto mode and permission settings. - The hosts, buckets and command names from commands Claude ran in your recent sessions in that project. It reads these commands, never your messages. It also offers two optional scans: the first word of each command in your shell history, and the remote hosts and names of repositories under your home folder. It asks before scanning. You then see the draft and accept or discard it as a whole. If you accept, it is saved to your personal Claude settings file, and you can edit single entries there afterwards. After saving, it also offers to remove allow rules that auto mode ignores, such as `Bash(*)`, or that approve destructive commands. If a lot of actions get blocked and you have no entries yet, Claude Code shows a dialog offering to run the command for you. The command is not available in cloud sessions; the documentation says to run it in an interactive session in your terminal. ## What should a team decide? The setup command saves time, but it writes down what your company trusts. That is a business decision, not just a technical one. ### 1. Decide who owns the list Someone who understands your systems should read the draft before it is accepted. The list says, in effect, "pushing here is fine, writing there is fine". An engineer or tech lead should confirm each line. A non-technical owner can still ask: "Does this list name anything that holds customer data or production?" ### 2. Name your production targets The documentation describes "protected deployment" and "sensitive remote target" settings. By default, any host or namespace whose name contains `prod` or `production` is treated as sensitive. Naming your real production targets makes the protective rules apply to exactly those instead of that guess. Leaving the go-live step to a person is a sensible habit. ### 3. Use deny rules for things that must never happen Auto mode's own settings are written in plain language that a model reads. For actions that must never run regardless of user intent or classifier configuration, the documentation says to use deny rules in managed settings (the company-wide settings an administrator distributes). They block the action before the classifier is consulted and cannot be overridden. An "ask" rule can add a human checkpoint before pushes and pull requests, even in auto mode. ### 4. Know the limits - The classifier does not read auto mode settings from a project's own settings file, so a repository cannot grant itself trust. Personal settings and company-managed settings are where they live. - Settings from different levels add together. A developer can extend the list but cannot remove entries your company's managed settings provide. The documentation also warns that a developer's own allow entry can override an organisation's softer block rule, so this is not a hard boundary. - A one-off instruction such as "don't push until I review" can be lost when a long conversation is compacted (older messages are shortened to save space). Use a rule for anything durable. ### 5. Check the result After saving, engineers can run `claude auto-mode config` to see the rules in force, and `claude auto-mode critique` to get AI feedback on custom entries that are ambiguous, redundant or likely to cause false blocks. Both commands are in the documentation. ## How does this relate to the risks of AI coding agents? Auto mode trades some oversight for speed. A well-taught classifier reduces needless stops while still blocking things like force pushes and secrets leaving the repository. A badly taught one either nags constantly or, worse, is set up so loosely that it approves things nobody meant to allow. The documentation notes that even in auto mode, pushes to branches named like deploy targets, such as `production`, are judged separately rather than waved through. ## Where does Atlas stand? Atlas is an AI engineering team built on Claude Code (see the [Atlas home page](https://bridge-terminal.com/atlas/)). It keeps a few decisions with people by design: production go-lives, spending, deleting data, sending anything outside and dropping scope are never decided for you. That is a separate layer from Claude Code's own auto mode. Atlas's published facts do not say that it prepares or reviews auto mode's trusted list, so treat that as something your team still does in Claude Code itself. ## Conclusion Auto mode only works well when it knows what is yours. The 19 October release put the guided setup within reach of more setups, so there is less reason to live with constant blocks or to loosen permissions too far. Run the command, have someone who knows your systems read the draft, keep hard limits in deny rules, and check the effective result afterwards. ## Questions people ask ### What is auto mode in Claude Code? It is a permission mode in which a second model, the classifier, reviews actions instead of asking you each time. According to Anthropic's documentation, it blocks anything irreversible, destructive or aimed outside your environment. Deny and ask rules are still checked first. ### What does /auto-mode-setup do? It reads your project files, settings and commands Claude ran in recent sessions, then drafts a list of trusted repositories, buckets and domains. You accept or discard the draft as a whole, and if you accept it is saved to your personal settings file. ### Why is auto mode blocking my push or file upload? By default the classifier trusts only the working folder and the project's configured git remotes. Other destinations, such as another company repository or a team storage bucket, stay blocked until you add them as trusted. ### Is /auto-mode-setup available on Bedrock or Vertex? Yes, from Claude Code 2.1.304, released on 19 October 2026. That version added it for Bedrock, Vertex, Foundry, Claude apps gateway and telemetry-disabled sessions. It is not available in cloud sessions; run it in an interactive terminal session. ### Should I use auto mode settings or deny rules for hard limits? Use deny rules. The documentation says that for actions that must never run, deny rules in managed settings block the action before the classifier is consulted and cannot be overridden. ## About Atlas: Auto mode and who decides what goes live Auto mode's trusted list says what an AI session may do without asking. Atlas's engineers are Claude Code sessions, and Atlas keeps production go-lives, spending, deleting data and sending anything outside as decisions for a person. Atlas does not yet draft or review auto mode's trusted list for you. — https://bridge-terminal.com/atlas/ ## Sources - [Configure auto mode — Claude Code docs](https://code.claude.com/docs/en/auto-mode-config) - [Choose a permission mode — Claude Code docs](https://code.claude.com/docs/en/permission-modes) - [Claude Code changelog (2.1.302, 2.1.304)](https://code.claude.com/docs/en/changelog) - [Claude Code releases on GitHub](https://github.com/anthropics/claude-code/releases) _Researched and drafted with Claude, then checked against the sources above. Atlas is an independent product, not affiliated with Anthropic or OpenAI._