Field note · 16 August 2026 · 8 min read

A count is not a verdict

In one week Claude Code started counting the rules a folder pre-approves, and offered to draft a trust boundary from evidence. Both are the right instinct. Both stop one step short of the question those labels make askable.

Claude Code now counts your permissions before the first prompt

This arrived in the second week of August, and it had never been surfaced before. Open a session in a folder with a populated allowlist and Claude Code stops to tell you how large that list is, and asks whether you trust it.

Accessing workspace: C:\Users\jjdub\code\cognitive-fab ⚠ This folder pre-approves 278 tool permissions in .claude/settings.local.json: mcp__plugin_github_github__get_latest_release, WebSearch, mcp__plugin_chrome-devtools…__new_page, and 249 more These will apply without asking. Only proceed if you trust this configuration. ❯ 1. Yes, I trust this folder 2. No, exit

The real dialog, from the repo this site is built in. The 278 is real too.

This is the right instinct, and it is a bigger change than it looks. The allowlist has been promoted from a convenience file that grows in the background to a security artifact you are asked to consent to, at the one moment you are actually paying attention. Two days after auto mode became the default, Anthropic was pointing at the surface that auto mode does not screen: the rules you already granted. Nothing in my repo changed overnight — those 278 entries were there the day before, silently.

But a count is not a verdict, and 278 is not a number anyone can act on. It tells you the pile is large. It does not tell you whether any two rules in it compose into a path from untrusted content to credential or source egress — and the pile got large the only way these ever do: one “yes, allow” at a time, each individually reasonable, none ever revisited. The dialog asks a question it gives you no instrument to answer. Only proceed if you trust this configuration. For most repos the honest answer is “I have no idea.”

polycheck reads the same files the dialog counts, and returns the verdict instead of the number.

Then it offered to draft the trust boundary for me

The same week, Claude Code proposed an auto-mode setup for this repo. Read it closely, because it is better than I expected — and it stops in an interesting place.

Review proposed auto-mode setup Environment Org-wide · Cloud provider(s): AWS (aws CLI used 47× in this project; also seen in shell history) · Repository visibility: Private (github.com/cognitive-fab/website, confirmed via gh) · Default / protected branches: Default branch unknown (origin/HEAD unset); no protected branches listed via gh, rulesets not queryable here — treat as unprotected status unverified, do not assume unprotected · Trusted internal domains: cognitivefab.com, www.cognitivefab.com, cartograph.cognitivefab.com (contacted repeatedly from this project's transcripts) · Sensitive remote targets: any namespace, host, or container whose name carries `prod` or `production` as a whole word or name segment (hyphen/underscore/dot-delimited — e.g. matches `prod-db`, not `producer`) Allow carve-outs none suggested — defaults look like they cover your usage

Excerpted from the real proposal, on this repo.

A declared trust boundary, drafted from evidence rather than from a questionnaire

That distinction is the part worth noticing. Nothing in that list came from asking me to fill in a form. Every entry was derived from something observable, and the derivation is stated next to the conclusion.

What it declaredHow it got there
Cloud providerCounted aws CLI invocations — 47 in this project, plus shell history.
Repository visibilityConfirmed through the GitHub CLI. Not asked, checked.
Trusted internal domainsThe hosts this project's transcripts contacted repeatedly.
Sensitive remote targetsA naming rule with a stated matching discipline: prod as a whole word or name segment, so prod-db counts and producer does not.
Branch protectionNothing. It could not query rulesets, so it wrote that the status is unverified and said do not assume unprotected.

That last row is the one I'd hire. Where the default branch was unset it left it unresolved rather than guessing; where protection could not be confirmed it recorded uncertain rather than absent. No silent defaults. That is exactly the discipline polycheck's INCONCLUSIVE verdict exists to enforce — colouring an unchecked thing green is the most dangerous thing a security report can do, and this proposal refuses to.

And here is where it stops

It produces labels. Trusted domains. Sensitive data locations. Sensitive remote targets. Protected IaC scopes. What it does not produce is an answer to the only question those labels make askable: can the permitted operations, in some order, carry untrusted input to an outbound channel with no gate in between?

Instead the proposal closes with this:

Allow carve-outs
  none suggested — defaults look like they cover your usage

That is a coverage claim, and coverage claims are the kind of thing you prove, not the kind of thing you eyeball. On this repo the same policy surface resolves to 134 modeled actions. “Looks like it covers” and “does cover” are different statements, and the distance between them is a graph search — not a judgment call, not a matter of care or seniority.

Scan → Label → Compile → Check. They shipped scan and label, and shipped them well — those labels are better sourced than most hand-written ones, and I would rather start from evidence than from my own memory of what this machine touches. The remaining two stages are mechanical. Compile is bookkeeping: allow is an ungated edge, ask a gated one, deny no edge at all. Check is a reachability question over a finite graph, and reachability is decidable — you do not need an opinion about it, you need a search. That is the part I build.

On 14 August, auto mode became the default

Anthropic turned on auto mode by default in Claude Code for Pro, Max and Team users, with Enterprise and API following within a month. A classifier reviews shell commands and actions instead of prompting you for each one.

It is a good change and the data behind it is not close.

89%
of dangerous commands caught by the classifier, in Anthropic's testing
13.6%
caught by human reviewers

The reason is the part everyone in security already suspected and nobody had numbers for: people approve 97% of the prompts they are shown. A checkpoint that is waved through 97 times in 100 is muscle memory, not a control.

Manual approval was never the control we told ourselves it was. So this is an improvement. It also quietly changes where your risk lives, and that is the part worth ten minutes.

When fewer calls reach a human, the policy file does more of the work

Two specifics from the announcement. Auto mode sets aside allow-rules broad enough to grant arbitrary code execution — python:*, Bash(node:*) and friends — so the classifier can review those commands rather than letting a blanket grant wave them through. Deny and ask rules continue to apply. Your settings files are not modified.

Read that again as a security engineer. Anthropic has independently concluded that a broad Bash(...) prefix is not a boundary, and neutralised that class of rule. Which means the levers that still bind your agent afterwards are deny, ask, and every allow-rule that isn't arbitrary code execution — and those are precisely the rules almost nobody has audited.

And the classifier judges one command at a time

That is not a tuning problem, it is structural. The lethal trifecta — Simon Willison's name for untrusted content, sensitive data and an outbound channel coexisting in one session — is a sequence of individually reasonable calls. WebFetch a page. Read a file. Have an MCP tool post the result.

Not one of those is a shell command. Each is separately fine. The hazard is the state they assemble, and no per-action screen, however good, has a vocabulary for “not both, in one session, after untrusted input.”

The remaining two stages are mechanical

Scan → Label → Compile → Check. The dialog and the setup wizard do the first two, from better evidence than a questionnaire would give them. Compile is bookkeeping: allow is an ungated edge, ask a gated one, deny no edge at all. Check is a reachability question over a finite graph, and reachability is decidable — you do not need an opinion about it, you need a search. That is what polycheck does, on the same files the dialog counts, and it returns the verdict instead of the number.

Jean-Jacques Dubray · Provable Trust · polycheck · Governing agents

© 2026 Cognitive Fab. All rights reserved. · Glossary