Allow
Classifier skipped. The action executes immediately.
git status, cargo checkAuto Mode
When Claude Code runs in auto permission mode, a classifier decides borderline calls instead of prompting. Reaching it takes care: Claude Code hands a hook ask straight back to the user without consulting the classifier, so defer is the only decision that routes there. tool-gates defers its gate asks under auto and keeps an explicit ask only where a human decision is the point.
Decision matrix
What the classifier sees.
tool-gates decides first. Only asks pass through to the classifier; allows and denies short-circuit.
Defer
Classifier runs and decides allow or deny silently.
cargo install fooDeny
Hard floor. Classifier bypassed entirely.
rm -rf /, curl | bashWhat changes
Auto mode strengthens the floor.
The deterministic rules tighten in four places, plus two ergonomic additions.
Pipe-to-shell escalates
Patterns like curl … | bash and eval "…" escalate from ask to deny under auto mode. No legitimate use case in autonomous operation; the classifier doesn't get a vote.
acceptEdits fast path is not trusted
Claude's hardcoded acceptEdits Bash allow list includes rm, rmdir, mv, cp, touch, and it matches the bare program name with no path check. Auto mode probes that list before calling the classifier, so tool-gates keeps an explicit ask when every sub-command sits on it. Path-aware allows like mkdir -p src/components and sed -i … file still succeed, and a mixed chain like mkdir -p dist && cargo build defers, because Claude's fast path cannot fire on it either.
Irreversible actions still ask
Ask rules marked auto = "prompt" hold their prompt under auto mode instead of deferring. These are the actions whose blast radius is external and irreversible, where the classifier knows nothing the rule does not: publishing a package, deleting an SSH or GPG key. The hold survives wrapper expansion, so pnpm run release cannot launder npm publish past it.
The review queue records who approved
Successful asks and defers both enter pending.jsonl. Each entry records whether a human approved the prompt or the classifier resolved a defer unseen, so tool-gates review never presents a silent classifier approval as prior consent.
Classifier denials get retry hints
If the classifier denies a call tool-gates would have allowed (e.g. cargo check), the PermissionDenied hook returns retry: true and the model takes another shot.
Skill auto-approval still fires
[[auto_approve_skills]] rules are explicit trust declarations and aren't revoked by opting into the classifier.
Configure via settings.json
The classifier itself is configured via autoMode.{allow, soft_deny, hard_deny, environment} in settings.json. Inspect merged config with claude auto-mode config (also defaults and critique).
Requires Claude Code 2.1.88+ for the PermissionDenied retry hook. Earlier auto-mode-capable builds still get the deny promotion, pattern narrowing, and pending-queue guard. The retry hint is the only version-gated feature.