A classifier model can vet every action and still block dangerous ones

The newest kind of approval gate replaces the human prompt with a second model. Claude Code’s auto mode routes every action through a separate classifier that reviews it before it runs and blocks anything that escalates beyond the request: production deploys, force pushes, curl | bash, mass deletion, and the like. The agent then runs long stretches without interrupting you, while the dangerous few are still caught.

This is a different trade from a mode toggle or a rule list. A mode sets a blanket oversight level (see: a permission mode toggle sets baseline oversight per session); rules encode specific allow and deny decisions (see: per-tool permission rules decide allow ask or deny for each call). A classifier adds judgment, which is what you need once an agent has enough autonomy to attempt consequential actions in the first place (see: the lethal trifecta makes agents exploitable). The cost is a second model in the loop and the fact that a classifier can be wrong, so the prompt is paused, not abolished, when the classifier blocks repeatedly.