Claude Code auto mode is default on Team. Pin Enterprise before they flip it.

Claude Code auto mode is no longer an experiment you opt into. On August 14, new sessions on Pro, Max, and Team started with a classifier approving tool calls instead of a human clicking through prompts. Anthropic’s own numbers: developers already approved 97% of those prompts. Enterprise, the API, Bedrock, and Foundry stayed opt-in — with a published plan to make auto mode the default “in the coming month.” If you run Team seats today, the default already moved. If you run Enterprise, the calendar is the work.

I am not writing this as a Claude review, and I am not writing it for one industry. This is software engineering. A permission prompt you rubber-stamp is not a control. A classifier you did not pin is not a control either. The commercial version of that work is Claude Code governance. What follows is the version you can run this week, before the Enterprise default flips underneath you.

Auto mode is a policy surface. Treat it like one.

For most of the last two years, “human in the loop” on AI coding tools meant a developer hitting Approve on a wall of bash prompts. That was already theater. Anthropic said the quiet part in the launch post: 97% approval, 13.6% catch rate on planted dangerous commands in a 1,053-person study, and a growing share of users who had already written Bash allow-rules or started sessions in bypassPermissions. Auto mode replaces that theater with a classifier. That can be safer than click-through. It is still not a named human, a CODEOWNERS file, or a required reviewer.

The split across plans is the part most teams will miss. Team is already on auto unless an admin pinned something else. Enterprise is still opt-in until Anthropic says otherwise. Mixed orgs therefore have two realities in the same company: overnight agents on Team laptops, and Enterprise developers still tapping through prompts — until the second default moves. That is a written posture problem, not a preference about which model is smarter.

Anthropic is explicit that auto mode does not eliminate risk, and still recommends reviewing high-stakes production infrastructure yourself. Treat that sentence as the policy seed. The rest of this post is how to make it real before a vendor changelog does it for you.

The this-week checklist

You do not need a six-week program. You need a written pin before the Enterprise default moves. Have engineering and security in the same room. If legal owns customer IP language, bring them for item five.

1. Inventory the plan mix. Who is on Pro / Max / Team vs Claude Enterprise vs API, Bedrock, Agent Platform, or Foundry? Screenshot it. Team already flipped on August 14. Everyone else is living on borrowed opt-in.
2. Read managed settings, not Slack. Is permissions.defaultMode pinned? Is permissions.disableAutoMode set to disable? If a Team admin already pinned a default, individual developers did not get a surprise on the 14th — but Enterprise still will unless you pin there too. If you cannot find the control, assume the built-in default is live.
3. Name the start mode in one sentence. Example: “Claude Code auto mode is allowed on application feature repos; it is disabled on infra, secrets, and production-adjacent paths.” Put it in the engineering handbook the same day. Verbal agreement is not a control.
4. Separate defaultMode from disableAutoMode. defaultMode chooses how new sessions start; a developer can still switch. disableAutoMode removes the option. If your questionnaire answer depends on a human approving each action, you need the second, not a reminder. Anthropic documents both.
5. Read the contracts you already signed. Customer MSAs, SOC 2 narratives, and “human in the loop” language often assumed a person clicked Approve. A classifier is a different control. If you cannot say that honestly, do not ship last year’s AI-tools paragraph to the next enterprise security packet.
6. Kill bypass theater. Broad Bash(python:*) allow-rules, bypassPermissions, and “don’t ask again” on the shell are how teams already opted out of review. Auto mode sets some of those aside while it is on. Switching modes brings them back. Inventory them. Do not congratulate yourselves for pinning auto while half the org starts in bypass.
7. Write the questionnaire answers. “Claude Code is approved as an editor/agent; auto mode is pinned off for production infrastructure; Team/Enterprise managed settings enforce that; diffs still get senior review before merge.” If you cannot say that honestly, do not pretend the old answer still matches the console.

If that list is more than your team will finish before the Enterprise default moves, that is the signal to bring in a Claude Code governance review — senior engineers, written posture, then a Copilot, Cursor, and Claude code audit on the repos those sessions already touched.

Team flipped. Enterprise is the calendar.

Do not wait for a polite email to treat this as real. Anthropic’s August 7 post said Enterprise and cloud partners stay opt-in “for now,” and that they plan to make auto mode the default across those surfaces in the coming month, with notice to Enterprise admins. Today is August 27. That window is days to a few weeks, not a quarter.

If GitHub is still your system of record, keep it. Auto mode does not change where the remote lives — Cursor Origin is that fight, and it is a different checklist. Mixing “where the repo is hosted” with “whether the agent can git reset --hard without asking” in one Slack thread is how both get skipped. Hosting is platform governance. Permission mode is this page’s job.

This is not an AI-code-quality post

We already published how to audit Copilot and Cursor output, and when to buy audit vs oversight vs MCP. That work still matters. It answers “what merged.” This week’s work answers “who, or what, approved the command.” Scanners do not pin managed settings. Neither does a model leaderboard.

Claude Code governance is the policy: approved start mode, which repo classes may run unattended, who can override, what happens when Anthropic changes the built-in default. Code audit is the diff. Most teams that moved fast on Claude Code now owe both. Neither is a healthcare-only problem. It is the same control conversation whether you ship a SaaS billing engine, an internal platform, or a mobile product.

Questions we hear this week

Is auto mode safer than clicking Approve?

On Anthropic’s published tests, yes — against the habit they measured, not against a senior engineer who actually reads the command. Use that data. Do not confuse “safer than 97% rubber-stamps” with “safe to leave overnight on the production Terraform repo.”

Should we disable auto mode everywhere?

Usually no. Feature work on isolated application repos is the case Anthropic designed for. Infra, secrets, customer-data paths, and anything that can reach production credentials are the case they carved out. Pin the split. Do not pick a company-wide vibe.

Does Shift+Tab count as a control?

No. Developers can switch modes. Admins pin. If your answer to a buyer is “people know to switch,” you do not have a control.

What about Copilot agent mode or Cursor agents?

Same class of decision, different admin console. Write the Claude Code pin this week because the default already moved. Reuse the language when you review Copilot and Cursor. The engagement is Claude Code governance, not a model bake-off.

Will this satisfy SOC 2?

It will satisfy the part of the questionnaire that asks which agents run unattended and how that is enforced. It will not replace a findings report on what already merged. Ask both questions. Answer both.

Do we need to stop using Claude Code?

No. You need to stop pretending last year’s “human in the loop” paragraph still describes the product you bought.

What if we already like auto mode?

Then pin it so a changelog cannot change it, name the repos where it is forbidden, and keep senior review on the merge. Preference without a pin is how you inherit the next default.

What to tell the board

Keep it to four lines:

• Our Claude Code Team seats already start in auto mode unless we pinned otherwise on August 14.
• Enterprise and cloud seats are still opt-in, with a vendor plan to flip that default in about a month.
• We will inventory plan mix, pin managed settings, and name repo classes that may never run unattended this week.
• We will update the AI-tools answers in the next security questionnaire so they match the console, not last year’s “human in the loop” sentence.

If you want that written by people who have had to defend toolchain decisions in diligence — not as a slide, as an engineering artifact — start with Claude Code governance. If the next question is the code those sessions already wrote, use the Copilot and Cursor audit, ongoing oversight, or the decision guide on audit vs oversight vs MCP. If the question is still where the remote lives, that remains platform governance and the Origin checklist.

I write from the seat of a working engineering company, not a tool vendor. More at antoniochagoury.com.