Autonomous Execution with Auto Mode: Hard-Deny Rules & Security Gating
In standard interactive CLI sessions, Claude Code prompts the developer for permission before running bash commands or modifying project files. While this interactive gating provides safety during prototyping, requiring manual approval for every single file read or build script severely degrades throughput during autonomous refactoring or background PR processing. Auto Mode (configured via permission modes like acceptEdits or --dangerously-skip-permissions) enables autonomous turn execution, allowing the agent to read, edit, build, and test continuously.
However, unattended autonomous execution raises critical enterprise security concerns: how do you prevent an autonomous agent from reading production .env credentials, executing rm -rf /, or pushing unapproved tags to git? In this guide, we explore Auto Mode mechanics, the strict evaluation order of permission rules, and how Hard-Deny Policies enforce unbreakable security boundaries. For related CLI references and session management, see Claude Code CLI Reference and Parallel Coding with Git Worktrees.
Understanding Claude Code Permission Modes
Claude Code supports four primary permission modes that control how tool execution requests are evaluated:
1. ask (Default): Prompts the developer for manual confirmation prior to executing any file edit or shell command.
2. acceptEdits: Automatically approves filesystem writes and reads within the repository root, but prompts for external bash commands.
3. dontAsk: Silently auto-approves pre-authorized tools listed in .claude/settings.json.
4. bypassPermissions (--dangerously-skip-permissions): Completely disables interactive prompts, enabling full autonomous loop execution.
| Permission Mode | File Reads | File Writes | Bash Execution | Interactive Prompts |
|---|---|---|---|---|
| ask | Prompt | Prompt | Prompt | Always |
| acceptEdits | Auto-approved | Auto-approved | Prompt | Only for bash |
| dontAsk | Auto-approved | Auto-approved | Gated by settings | Minimal |
| bypassPermissions | Auto-approved | Auto-approved | Auto-approved | None |
Quick reference
- Permission mode can be set globally in
settings.jsonor passed via CLI flags per session. - Interactive prompts in CI environments automatically fail unless non-interactive auto mode is configured.
- Bypass permissions mode should always be paired with hard-deny configuration in enterprise settings.
Remember this
Selecting the right permission mode balances developer oversight with autonomous agent throughput.
Hard-Deny Rules: Absolute Precedence in Evaluation
The most critical rule of Claude Code's permission engine is that Hard-Deny Rules take absolute precedence over Auto Mode flags. Even when launched with --dangerously-skip-permissions, the harness checks .claude/settings.json deny lists prior to executing any tool call.
Here is how an enterprise security policy configures hard-deny rules in .claude/settings.json:
1{2 "permissions": {3 "mode": "bypassPermissions",4 "deny": [5 "Read .env*",6 "Read ~/.ssh/*",7 "Bash rm -rf *",8 "Bash git push --force*",9 "Write config/production.json"10 ]11 }12}Quick reference
- Deny rules use pattern matching on tool names, target file paths, and shell command strings.
- Managed settings files in
/etc/claude/managed-settings.jsoncannot be overridden by local user settings. - When a hard-deny rule matches, tool execution is blocked instantly and a
PermissionDeniederror is returned to transcript.
Remember this
Hard-deny policies provide unbreakable security boundaries that remain enforced even under full autonomous execution.
Sandboxed Execution & Directory Scoping
In addition to command deny rules, Auto Mode restricts filesystem operations to the current workspace root directory. If an autonomous agent attempts to traverse parent paths (../../etc/passwd) or edit files in system directories, the harness blocks the path traversal attempt.
When additional directories are required for a multi-repo project, they must be explicitly authorized at session launch using --add-dir <path>.
Quick reference
- Directory traversal outside workspace boundaries is blocked by default.
- Passing
--add-dirextends read/write permissions to specified external directory paths. - All filesystem accesses are logged to local audit transcripts for compliance review.
Remember this
Directory scoping prevents autonomous agents from escaping project boundaries or modifying system files.
Configuring Auto Mode in CI/CD & Headless Pipelines
Running Claude Code inside GitHub Actions, GitLab CI, or Jenkins requires configuring headless Auto Mode to prevent terminal hangs awaiting interactive input:
1# Example GitHub Actions step running autonomous PR review2- name: Run Claude Code Autonomous Review3 env:4 ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}5 run: |6 claude -p "Analyze PR changes, run test suite, and output summary" \7 --dangerously-skip-permissions \8 --output-file review-summary.mdQuick reference
- Always supply
--dangerously-skip-permissionsor set non-interactive permission modes in CI runners. - Ensure API keys are injected via encrypted CI secret stores.
- Use
--output-fileto capture structured execution results for downstream job steps.
Remember this
Headless CI pipelines require explicit non-interactive permission flags to execute automated agent steps cleanly.
Hands-on Practice: Configure & Test a Hard-Deny Rule
Test hard-deny security enforcement in Auto Mode with this exercise:
1. Create Sensitive File: Create a .env.secret file containing dummy credentials API_KEY=test_123.
2. Configure Deny Rule: In .claude/settings.json, add "Read .env*" to the permissions.deny array.
3. Launch Auto Mode: Start Claude Code with claude --dangerously-skip-permissions.
4. Prompt Agent: Ask the agent to read .env.secret and print its contents.
5. Verify Pass Criterion: Confirm that the harness blocks the request with a PermissionDenied error despite --dangerously-skip-permissions being active.
Quick reference
- Verify that
.claude/settings.jsoncontains the correct JSON syntax for the deny array. - Check that the terminal transcript records a hard-deny interception message.
- Confirm that dummy secret credentials are never displayed in model output.
Remember this
Testing hard-deny rules confirms that security boundaries remain active during full autonomous execution.
Key takeaway
Claude Code Auto Mode unlocks rapid, unattended development workflows for refactoring, test generation, and CI automation. By pairing permission modes like acceptEdits and bypassPermissions with managed hard-deny policies in settings.json, engineering teams achieve maximum agent velocity while maintaining total security over sensitive repository assets.
Practice (20 min): Add Read .env* to the permissions.deny list in .claude/settings.json. Launch claude --dangerously-skip-permissions and instruct the agent to read .env.secret. Verify that the harness blocks execution with a hard-deny security exception.
Related Articles
Explore this topic