[FEATURE] Auto mode classifier should evaluate declared intent, not just the action

Preflight

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

Auto mode's classifier evaluates each tool call in isolation: the command, against a
policy. This catches destructive and out-of-scope actions well — but it is
structurally blind to a different failure class: a syntactically harmless command
executing a wrong premise.

The agent's reasoning about why it is running a command lives in its scratchpad,
where neither the classifier nor the user sees it before execution. When the
reasoning is wrong but the command is innocent, nothing in the current permission
model can catch it.

Real-world example (observed, not hypothetical)

While benchmarking a local LLM inference server (loopback HTTP service), Claude Code
proposed running the benchmark over SSH from another machine. Every individual
command was approvable — ssh host 'python bench.py ...' is not destructive, not
out-of-scope, not injection-driven. The classifier would pass it. A human in manual
mode would pass it.

But the intent was "measure loopback service performance", and the action never
touched loopback: an SSH-launched client resolves and connects differently than a
local console client. Running locally instead exposed a dual-stack IPv6/IPv4 bind
bug causing multi-second connection timeouts — a bug that was invisible on the
execution path the agent chose, and would have silently poisoned every benchmark
number gathered through it.

Intent and action diverged. No current mechanism — classifier, permission prompt,
deny rules — evaluates that divergence, because none of them see the intent.

A second observed instance, same session family: after WebFetch returned 200 OK
with 927 KB of content, the agent nearly proceeded to reason from it — but the
payload was a client-side-rendered JS shell containing none of the documentation it
was fetched for. Transport success, premise failure. Again: no individual action was
dangerous; the plan was quietly wrong.

Proposed Solution

Two additions, one mechanism:

1. Declared intent per action (the Codex CLI existence proof)

The idea that the permission layer should know why an action is being taken is
not new — this tracker has circled it repeatedly (see Related issues). What was
missing was proof that it is practical at per-command granularity. OpenAI's
current Codex CLI now ships exactly that: a plain-language Reason field
attached to each approval request — the agent states why it wants to run the
command, before it runs:

Reason: Do you want to list your GitHub Gists and verify the setup Gist's files so I can choose the correct image Gist and avoid duplicating the README? $ gh gist list --limit 100; gh gist view a07f... --files

!Codex CLI approval prompt showing the per-command Reason field

The user approves a stated goal, not a command string. If the reasoning is wrong,
it is visible before execution instead of reconstructed afterwards from a diff.
Seeing this in a shipping product removes the practicality objection: the agent
already produces this reasoning internally, and Codex demonstrates it compresses
into one crisp line per command with no perceptible cost.

2. Classifier validates action against declared intent

This is the part Codex does not do, and where Claude Code's classifier architecture
is already positioned to go further: the auto mode classifier receives both the
declared intent and the proposed action, and evaluates a new question —

Given what the agent says it is trying to achieve, will this action actually achieve it?

That is plan-level validation instead of command-level policy checking. It catches
the "right command, wrong premise" class:

• benchmark intent + remote execution path → flag: measurement will not exercise

the stated target

• "verify documentation says X" + fetch that returned a JS shell → flag: evidence

does not support the conclusion about to be drawn

• "edit gist A" + command targeting gist B → flag: target mismatch

None of these are dangerous. All of them waste the session, corrupt downstream
conclusions, or silently ship wrong results — which for agentic workloads is often
the dominant failure mode, not rm -rf.

Why this fits auto mode rather than fighting it

Anthropic's own published numbers motivated replacing manual approval: users
approve ~97% of permission prompts, humans caught 13.6% of planted dangerous
commands vs. 89% for the classifier, and human catch-rate degrades to ~5% after 50
prompts. Manual review failed because prompts were frequent and uninformative.

Codex CLI's field experience shows the mirror-image failure: its prompts are
informative but frequent, and the dominant community response is
--approval-mode never / --full-auto — the Reason field is worthless to a user
who has configured the prompt away. The dominant usage pattern amplifies this:
many users run the agent in a small terminal pane beneath their editor, where
every extra prompt line has real screen cost. An informative, multi-line prompt
is only affordable when it is rare — verbosity and frequency cannot both be high.

The two datasets together point at one viable design:

• Classifier filters → prompts become rare (Claude Code already has this)
• Declared intent → the rare prompts that survive are informed decisions,

and the classifier gains the context to catch premise errors (this proposal)

Rare and reasoned prompts is the only combination that survives contact with
actual humans. Frequent+reasoned gets disabled (Codex evidence); rare+opaque leaves
the human rubber-stamping the few prompts they do see, and leaves the classifier
blind to intent divergence (current state).

Sketch of behavior

• Agent attaches a one-line declared intent to each tool call (it already produces

this reasoning internally; this surfaces it as a structured field).

• Classifier evaluates: (a) existing safety policy, (b) **intent/action

coherence**.

• Coherence failures are not hard blocks by default — they surface as a prompt

with the declared intent shown, so the human decision is informed:
"Agent says it wants X; this action appears to do Y instead. Proceed?"

• In the transcript, the declared intent is logged next to the command — making

post-hoc review of long autonomous runs tractable ("read the intents, spot-check
the divergences") instead of requiring a full command-by-command replay.

The reasoning-blind objection, addressed head-on

The auto mode engineering post states the classifier is deliberately
reasoning-blind: Claude's own messages are stripped because "if the classifier
read the model's own justifications, it can be talked into the wrong decision,"
and including assistant messages degraded performance on the overeagerness test
set. This proposal is aware of that finding and is not asking to reverse it.
Three distinctions:

1. Structured field ≠ free-form reasoning. A one-line declared intent is a

constrained, schema'd input — closer to a tool-call argument than to
persuasive prose. The attack surface of "talk the classifier into it" scales
with rhetorical room; a single goal statement offers little.

1. Different question, different failure direction. The safety question

("is this dangerous?") is where agent self-justification is adversarial —
the agent benefits from talking the classifier down. The coherence
question ("does this action serve the stated goal?") inverts the incentive:
a false intent declaration doesn't unlock a dangerous action (safety
evaluation stays reasoning-blind, unchanged); it only creates a logged,
checkable false statement next to the command. That is strictly more
auditable than today's silent scratchpad.

1. The human-facing half needs no classifier change at all. Showing the

declared intent in the prompts that already survive filtering — so the ~3%
of actions that do reach a human are approved as informed decisions —
requires zero modification to the classifier's input and inherits none of
the tested degradation. If the coherence-validation half is deemed too
risky, this half stands alone and is the minimal viable version of this
request.

If Anthropic's evaluation shows even a structured intent field degrades safety
classification, run coherence as a separate classifier pass with its own
input — the safety pass stays exactly as shipped.

Related issues (searched; the idea has been circled, never proposed)

This tracker has brushed against the underlying gap — the classifier deciding
without knowing what the agent is trying to achieve — several times, from
several directions:

• #59231 (closed as duplicate of #50532) — prompt instead of hard-refuse on

high-risk classifications (escalation UX; doesn't touch intent declaration
or coherence)

• #39097 — classifier dry-run/observability mode; #38500 — pre-classifier hook

(visibility into classifier decisions, not validation of agent intent)

• #58222, #60004 — pass conversational authorization context to the classifier

(classifier input scope for authorization, not intent/action coherence)

• #74080 — parent-turn intent invisible to classification inside forked skills

(the closest the tracker comes: intent invisibility named as the root
cause, but framed as an authorization bug, not as a mechanism)

• #75325 — same-action re-blocking and rewording-treated-as-evasion

(classifier trust dynamics; adjacent, not overlapping)

All of the above address what the classifier sees or how its decisions
escalate — and several are, at root, the same complaint: the classifier
lacks intent context. None propose the mechanism this request describes — a
structured declared intent per action, evaluated for coherence with the
action and shown to the human. The missing piece was an existence proof that
per-action intent declaration is workable in practice; Codex CLI's shipped
Reason field (§1 above) now provides it.

Costs, acknowledged

• One extra short generation per tool call (intent line) and a marginally larger

classifier input. Auto mode already runs a classifier per action; this widens
its input rather than adding a round-trip.

• Intent declarations can be wrong or vacuous. That is acceptable: a vacuous

intent next to a consequential command is itself a reviewable signal, and
today the same wrong reasoning executes with zero visibility.

• False-positive coherence flags. Tunable; and unlike safety blocks, a coherence

prompt that is wrong costs one keystroke, while a premise error that slips
through costs a corrupted work product.

Environment

• Claude Code v2.1.235, Fable 5, auto mode, Windows 11 (git-bash + PowerShell) and

remote Linux over SSH

• Daily multi-session agentic use (3–8 parallel sessions); the examples above are

from real sessions — Codex screenshot embedded above, others available on request

References

• Auto mode engineering post (reasoning-blind design, two-stage classifier,

tested alternatives): https://anthropic.com/engineering/claude-code-auto-mode

• Auto mode announcement and study numbers: https://claude.com/blog/auto-mode
• Auto mode default rollout (Aug 14, 2026), 97% / 13.6% / 89% figures:

https://techcrunch.com/2026/08/09/anthropic-is-turning-claude-codes-auto-mode-on-by-default/

• Codex CLI approval UX with per-command Reason field: OpenAI Codex CLI ≥ current

release (screenshot embedded above)

• Codex community response configuring prompts away (motivating "rare AND

reasoned"): https://github.com/openai/codex/discussions/7740