Auto mode: classifier denials should fall back to an interactive permission prompt when the user is present

Summary

In auto permission mode, when the safety classifier denies an action there is no escalation path to the user. The denial is final, even when the user is actively in the conversation and has explicitly, repeatedly authorized the exact action in chat. The user never sees the familiar Allow/Deny prompt and gets no signal that one would have appeared in default mode.

Real session where this hurt

A long migration session (moving git repos out of a OneDrive-synced folder that was corrupting them) in Claude Desktop / Cowork, running in auto mode:

1. Agent needed to run a cutover script (stop 21 scheduled tasks for a local paper-trading bot, re-point them to the new path, restart). Classifier denied - reasonable default.
2. User explicitly granted permission in chat ("permission granted to run option B"). Classifier still denied - it can't verify conversational context, also understandable.
3. Agent tried to add narrow allow rules to .claude/settings.json per the denial message's own suggestion ("the user can add a Bash permission rule to their settings"). Also denied as self-permission-editing - correct!
4. Dead end. The only way forward was the user manually switching the session out of auto mode entirely, which they only learned was possible because the agent explained it. The user's reaction: "What about the prompt I normally get to give permissions? Never had to create/modify .claude settings before."

Suggestion

When the auto-mode classifier reaches a deny verdict on a soft boundary (destructive-but-user-clearable actions, not hard security boundaries like self-permission-edits), and an interactive user is present, fall back to the standard permission prompt instead of flat denial - i.e. give the classifier an "ask the user" verdict, mirroring the ask list in permission rules. The human clicking Allow is strictly better signal than anything the classifier can infer, and it's what users coming from default mode already expect.

Without that fallback, auto mode turns "the user must decide" into "nobody may decide," and the workaround (mode switching mid-session) is undiscoverable.

Environment

• Claude Desktop (Cowork) on Windows 11, Claude Code harness, auto permission mode
• Reported at the user's explicit request after the session completed successfully via mode switch