[FEATURE] Allow Auto-mode to be disabled organization-wide, but still be re-enabled with a settings.json option

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

We have a company requirement to not allow Auto mode outside of a sandbox. We enforce this by disabling the option. However, this leaves only "defaultMode": "bypassPermissions" in our sandboxes — safe if we're careful with our firewall rules for the sandbox, but riskier than necessary for our intention.

Proposed Solution

Allow some configuration by which "defaultMode": "auto" allows re-enabling the choice of auto mode, in cases where "defaultMode": "bypassPermissions" is already allowed.

Alternative Solutions

_No response_

Priority

Medium - Would be very helpful

Feature Category

Configuration and settings

Use Case Example

_No response_

Additional Context

_No response_