How Does AI Interpret Consent: A Look Inside Claude Code's Safety Classifier

I'll pull the source article so the paragraphs stay grounded in its actual claims, then draft the five-section analysis you asked for.Highflame’s Justin Albrethsen reverse-engineered Claude Code’s auto-mode safety path after the product refused the documented command claude auto-mode defaults mid-research, returning only the fixed line “Permission for this action was denied by the Claude Code auto mode classifier. Reason: Blocked by classifier.” In --permission-mode auto, Claude Code 2.1.220 routes consequential actions through a second model, claude-sonnet-5, before execution. Roughly 44 KB of that classifier’s system prompt is neither printed by the CLI nor documented publicly; Albrethsen recovered it by proxying traffic with mitmproxy. The printable portion, about 60% of what the classifier sees, is a soft-deny block list of sixty-four rules covering force pushes, data exfiltration, production deploys, and agent self-supervision tricks such as Session Transcript Tampering and Tmux Self Drive.

The architecture is a five-gate pipeline. permissions.deny and permissions.ask run in the harness before any model sees the action—a deny on Bash(rm *) produced zero classifier calls in the capture—and only that deny tier is a true policy boundary. Auto-approval then skips the classifier for reads, in-project edits, and narrow shell allows such as Bash(npm test). Everything else hits triage: a claude-sonnet-5 call with max_tokens 64, reasoning off, returning a severity score from 0 to 100 with 50 as the block line, grading harm only and ignoring what the user asked for. Flagged actions escalate to adjudication with max_tokens 8192, where the model can overturn triage; on an explicit force-push instruction, triage scored 85 and adjudication dropped it to 15 after reading the conversation. Below all of that, API Usage Policy refusals still surface as stop_reason: refusal. Anthropic’s own write-up on the two-stage design reports 0.4% false positives against 17% false negatives.

For engineers running agents with minimal prompts, the real boundary is not the block list but the unprintable consent model. Soft rules clear only when a user meets a must-name bar: Path A if their own message names both the destructive operation and its target, Path B if the agent’s prior proposal named those items and the user replied with an affirmation such as “yes.” Naming the enclosing task—“get the deploy working”—does not name the dangerous step. Path B is structurally delicate because a bare yes draws specificity from model-authored prose; the prompt stacks defenses so a menu of actions is not cleared by one go-ahead, an interrupting notification voids the referent, and quoted User: or Assistant: lines never count as turn boundaries. A third category, adversarial-pattern rules (Instruction Poisoning, Auto-Mode Bypass, Self-Modification, Credential Exploration, and similar), does not clear on “yes, do it anyway” at all—only when the user confirms the flag was a false positive. Cross-session messages from another Claude agent never establish intent, and relaying a peer’s blocked action is named as cross-session permission laundering.

That last rule is the market signal. Most coding-agent products still treat permissions as a local allow/deny list or a human click per tool call; few ship a formal consent calculus for multi-agent fleets, transcript integrity, or peer-session privilege escalation. Anthropic is also explicit about scope and hardness: fabricating or misreporting results, poor code, loops, and wasted tokens are out of scope for the classifier; silence is not consent; only permissions.deny is hard, while an organization’s soft_deny can be overridden by a developer’s local allow because the combination is additive. When the classifier is unreachable or unparsable, auto mode fails closed rather than degrading into an unmonitored agent. The design is among the more carefully specified agent-runtime policies in production, and still leaves security teams without the severity score, matched rule name, or adjudication thinking that exist for every decision—most sessions only show the fixed “Blocked by classifier” string.

If you rely on auto mode, put company-critical blocks in managed permissions.deny settings evaluated before any model runs, not in soft rules you hope the consent bar will uphold. Treat Path B approvals as audit risk: require proposals that name the exact dangerous parameter, and do not treat an uninterrupted run of actions as tacit yes. Watch whether Anthropic surfaces rule names and adjudication rationales outside the local /permissions view, whether fleet vendors adopt an explicit cross-session laundering rule, and whether the 17% false-negative rate shrinks as the unprintable half of the rulebook is revised—none of those numbers or mechanisms are visible from the product’s default deny message alone.