Claude Code auto mode unavailable or classifier blocked

Updated 2026-11-06

Claude Code's auto mode hands permission decisions to a classifier instead of prompting you on every command. When it works, the status bar shows ⏵⏵ auto mode on and long tasks keep moving. When it doesn't, you see one of two different problems:

• Auto mode isn't available to the session at all — it never enters the Shift+Tab cycle, or the session starts in Manual with no classifier running.
• Auto mode is on, but the classifier fails or blocks — actions refuse with "cannot determine the safety", "no safety verdict", or auto mode pauses after repeated blocks.

Those need different fixes. This page is a checklist for both, checked against Anthropic's docs on 2026-11-06. For the wider permission-mode, allow-rule and sandbox setup across Claude Code, Cursor and Codex, see how to stop asking permission for every command.

Symptom → which problem you have

1. Make sure auto mode can start

The docs list these availability requirements:

• Plan: all plans.
• Organization: on Team and Enterprise, auto mode is on by default. Admins can turn it off with permissions.disableAutoMode: "disable" in managed settings. That removes Auto from the cycle, and a session started with --permission-mode auto starts in Manual instead.
• Model: on the Anthropic API and Claude Platform on AWS — Claude Opus 4.6 or later, Sonnet 4.6 or later, Haiku 5.5, or a Fable model. On Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry and signed-in Claude apps gateway sessions the list is narrower (Sonnet 5 or later, Opus 4.7 or later, Haiku 5.5, Fable). Older models such as Sonnet 4.5 are not supported for auto mode on any provider.
• Provider: available by default on the Anthropic API, Claude Platform on AWS, Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry, and signed-in Claude apps gateway sessions.

Anthropic may also turn auto mode off server-side, or reject it for your account. A session that received either answer keeps auto mode off until it ends — start a new session later.

Since Claude Code v2.1.283, auto mode is the built-in starting mode for interactive terminal and VS Code sessions. If you still start in Manual with no error, check where you put defaultMode:

{
  "permissions": {
    "defaultMode": "auto",
    "ask": [
      "Bash(git push *)",
      "Bash(gh pr create *)"
    ]
  }
}

Put that file at ~/.claude/settings.json. The docs are explicit: "auto" (and "bypassPermissions") do not take effect from a project's .claude/settings.json or .claude/settings.local.json. A project file can still set Manual, acceptEdits or plan. The ask rules in the example keep a human checkpoint before git push and gh pr create even while auto mode is on — content-scoped ask rules always prompt.

One-session override without editing a file:

claude --permission-mode auto

For claude -p and Agent SDK runs, the built-in start mode is Manual (config value default) as of v2.1.302. Pass --permission-mode auto there if you want the classifier, or pass an allowlist with --allowedTools.

2. When the classifier fails

Auto mode can be available and still refuse an action. The error reference names these shapes (checked 2026-11-06):

• Classifier model temporarily unavailable. Message like <model> is temporarily unavailable, so auto mode cannot determine the safety of <tool>. Often rate-limited, overloaded, timed out or connection-failed. Retry; reads and working-directory edits keep working. On Amazon Bedrock, a message that returns on every retry can mean your account cannot invoke the named classifier model.
• Unparseable classifier response. Auto mode could not evaluate this action and is blocking it for safety — run with --debug for details. Retry; use claude --debug if it repeats.
• Separate safety check refused the classifier request because of earlier conversation content. Retrying the same conversation will fail the same way. Switch permission mode to approve the action, or start a fresh session without the triggering content. These denials do not count toward the pause thresholds.
• Conversation too long for the classifier. Interactive sessions fall back to a normal permission prompt; run /compact. Non-interactive -p runs without a prompt tool skip the action and continue.
• Server-side review returned no verdict. Under server-side classifier review, Claude Code denies the action rather than run it unreviewed. After ten responses in a row with no verdict, auto mode stops the turn. A gateway that cuts streams short or rewrites results is a common cause — see the next section.

When a blocked action did get a classifier verdict, open /permissions → Recently blocked, read the command, and press r to approve a retry. Approving there does not add a lasting allow rule; for a pattern you want forever, add it under autoMode.allow or fix the missing environment entry.

3. Server-side checks, gateways and the billing notice

Where server-side classifier review is on, the server checks actions as part of the session's own model requests at no charge. If those checks never reach your session, Claude Code falls back to its own classifier requests. On accounts that bill those requests you can see:

We're changing auto mode to no longer charge for classifier requests in Claude Code. However, this session isn't eligible.

Press Enter to continue (auto mode keeps working; classifier requests are billed as before). Esc cancels the held action. Pro, Max, Ultra and Team plans never see this notice.

The usual cause is an LLM gateway or proxy that strips headers, drops fields such as safeguards, or rewrites responses. Ask the gateway to pass requests and replies through unchanged. If it cannot, skip asking the server:

export CLAUDE_CODE_AUTO_MODE_SERVER=0
claude --permission-mode auto

Or set the same variable under the env key in settings. On a direct Anthropic API connection the variable needs Claude Code v2.1.281 or later. In a running auto-mode session, /status shows an Auto mode server row as Enabled or Disabled.

4. Repeated blocks → teach the classifier your infrastructure

If the classifier blocks an action 3 times in a row or 20 times total, auto mode pauses and Claude Code resumes prompting. Approving the prompted action resumes auto mode. The thresholds are not configurable.

Repeated false positives usually mean the classifier is missing your org's repos, buckets or domains. By default it trusts only the working directory and the remotes configured when the session started. Add trusted infrastructure in user or managed settings (not in a project's .claude/settings.json — the classifier ignores autoMode there on purpose):

{
  "autoMode": {
    "environment": [
      "$defaults",
      "Organization: Acme Corp. Primary use: software development",
      "Source control: github.com/acme-corp and all repos under it",
      "Trusted internal domains: *.corp.example.com, api.internal.example.com",
      "Key internal services: Jenkins at ci.example.com, Artifactory at artifacts.example.com"
    ]
  }
}

Keep "$defaults" in the array so you inherit Anthropic's built-in entries. Leaving it out replaces the whole list for that section.

Faster path in a session: run /auto-mode-setup and review the draft before accepting. Then confirm what the classifier will actually use:

#!/usr/bin/env bash
# Print the auto-mode rules Claude Code's classifier actually uses.
# Run from your own shell (not inside a Claude session).
set -euo pipefail

echo "== Claude Code version =="
claude --version

echo
echo "== Built-in defaults (no personal overrides) =="
claude auto-mode defaults | python3 -c 'import json,sys; d=json.load(sys.stdin); print("keys:", sorted(d));
[print(f"{k}:", len(d.get(k, []))) for k in ("environment","allow","soft_deny","hard_deny")]'

echo
echo "== Effective config (your settings applied) =="
claude auto-mode config | python3 -c 'import json,sys; d=json.load(sys.stdin); print("keys:", sorted(d)); print("environment entries:", len(d.get("environment", [])))'

echo
echo "Tip: in a running auto-mode session, /status shows Auto mode server as Enabled or Disabled."

We ran claude auto-mode defaults and claude auto-mode config on 2026-11-06 with Claude Code 2.1.197 on this machine (no custom autoMode in settings). Both returned JSON with keys allow, environment, hard_deny and soft_deny; the defaults counted 9 environment entries, 16 allow rules, 55 soft_deny rules and 1 hard_deny rule. We did not start an interactive auto-mode session or call a model for a live classification.

For a hard guarantee that a command always prompts, prefer permissions.ask (as in the user-settings example) over a conversational "don't push until I review" — conversation boundaries can disappear after context compaction.

5. When to stop fighting the classifier

• Fewer prompts without the classifier: Manual mode plus the Bash sandbox in auto-allow (/sandbox), or acceptEdits if file edits are what keeps asking. See sandbox blocking npm install for domain and write-path setup.
• Locked-down CI: --permission-mode dontAsk with an explicit --allowedTools list.
• Fully unattended in a container: --dangerously-skip-permissions as a non-root user inside a container or VM only — not a substitute for auto mode on your laptop.

Auto mode "reduces permission prompts but does not guarantee safety". Keep ask or deny rules for the commands you never want the classifier to clear on its own.

A ten-minute checklist

1. Confirm Auto appears when you press Shift+Tab. If it doesn't, check model, provider and disableAutoMode.
2. If sessions start in Manual with no error, move "defaultMode": "auto" to ~/.claude/settings.json.
3. Add ask rules for git push and your publish command.
4. Run the check script. If routine internal actions keep blocking, add autoMode.environment entries or run /auto-mode-setup.
5. If you hit the gateway billing notice, fix pass-through or set CLAUDE_CODE_AUTO_MODE_SERVER=0.
6. If the classifier is flaky and you need to ship, switch to Manual + sandbox auto-allow for the session and come back later.

FAQ

Sources

Official docs, checked 2026-11-06.

• Claude Code docs: Choose a permission mode (availability, defaultMode, repeated-block fallback)
• Claude Code docs: Configure auto mode (environment, defaults, claude auto-mode CLI)
• Claude Code docs: Auto mode classifier request charges (gateway / server fallback notice)
• Claude Code docs: Error reference (auto mode cannot determine safety, no verdict)
• Claude Code docs: Configure the sandboxed Bash tool (pair with auto mode)