What's the biggest difference between Auto Mode now and the March research preview?
The biggest difference is that both reach and barrier to entry changed at the same time. When it launched in March, Auto Mode was limited to Team plan users, and customizing its rules meant hand-editing ~/.claude/settings.json yourself, with a clear understanding of the schema — meaning that while the feature existed, relatively few people actually used or customized it. After 8/14, on one hand it became the default mode for new sessions across Pro, Max, and Team plans, requiring no opt-in. On the other hand, a graphical /permissions tab was added for rule configuration, and the underlying rules themselves can now be written directly as plain sentences, with no need to touch settings-file syntax.
Put simply, the March version was "an optional feature for advanced users." The version after 8/14 is "default behavior most people encounter from day one, with the barrier significantly lowered."
Why did Anthropic change rule-writing from settings-file syntax to plain sentences, and what problem does this solve?
The most direct problem is that the old approach made "understanding settings-file syntax" a prerequisite for "being able to customize security rules" at all — even if a team clearly knew what they wanted to prohibit Claude from doing (say, "don't run database migrations outside the migrations CLI"), that clear intent couldn't actually get written into a rule if nobody on the team was fluent in JSON settings-file syntax. That means the old approach didn't filter out "teams without security awareness" — it filtered out "teams with security awareness who weren't fluent in settings-file syntax." Those two things aren't actually correlated.
Switching to plain sentences means a rule's expressive power — whether it can clearly say what you want — is no longer bottlenecked by syntax Skill. Someone who can clearly describe "what I don't want Claude to do" is now enough to write an effective rule, without learning a separate settings-file language. This also explains why the claude auto-mode critique check command was added at the same time — plain sentences lower the barrier to writing rules, but can also produce ambiguous or conflicting rules from imprecise wording, and critique fills exactly that gap.
What's the actual practical difference between hard_deny and soft_deny, and where should I put a given rule?
hard_deny blocks unconditionally — regardless of context, regardless of whether you explicitly asked for it, a rule written here is never allowed through. It fits actions that should never happen under any circumstances, like the official example "never send repository contents to a third-party code-review API" — the kind of action that, once it happens, typically can't be undone.
soft_deny blocks by default, but can be overridden — if you explicitly ask Claude to do it in the current conversation, or there's another allow rule matching the same context, the soft_deny Block gets lifted. This fits actions that shouldn't happen most of the time, but do have legitimate exceptions — like the official example "never run database migrations outside the migrations CLI." That shouldn't normally happen, but if you genuinely have a reason to handle it manually today, explicitly asking still lets it go through.
The key practical question is: is there any scenario where this action shouldn't run even if I explicitly ask for it in the moment? If so, put it under hard_deny. If you can imagine a day when you'd deliberately ask Claude to do this (even rarely), soft_deny is the more sensible place for it.
If my team currently hasn't set up any custom rules at all, where should we start? Is there a reasonable first move?
Step one is confirming what you're actually relying on right now — run claude auto-mode defaults once to see exactly what scenarios Anthropic's built-in default rules cover. This tells you clearly "if I write nothing right now, these are the rules actually protecting me," rather than guessing based on assumption.
Step two is auditing your project for actions that would be unrecoverable if they happened, and that the built-in defaults might not cover — this kind of team-specific project context (a particular database, a particular third-party service) typically doesn't show up in generic built-in rules, because that's knowledge belonging to your team; only you know what actually needs guarding against. Write a few rules covering the scenarios you identify — you don't need to cover everything at once.
Step three, after writing the rules, run claude auto-mode critique once to confirm there's nothing ambiguous or conflicting before actually relying on it. Because rules live in user settings, once written they apply across every one of your projects — no need to configure each repository separately. But that also means if a rule itself has a problem, the impact is just as widespread across every project, which is exactly why the critique step isn't one to skip.
If you looked up a Claude Code Auto Mode tutorial earlier this year, what you'd see today is different. Since launching as a research preview in March 2026, Auto Mode was originally limited to Team plans, with rule configuration requiring you to hand-edit ~/.claude/settings.json and understand its schema. Starting August 14, 2026, Auto Mode became the default permission mode for new sessions on Pro, Max, and Team plans, a graphical settings tab was added for configuring rules, and the rules themselves can now be written directly as plain sentences instead of complex syntax.
If you start a new session on Pro, Max, or Team after 8/14, the default permission mode is Auto Mode — no longer the mode that asks for approval on every action. That doesn't mean your existing setup gets overridden: if you've set your own default mode, it stays in place until you actively accept a switch prompt; an organization-managed default likewise doesn't change because of this update. If you want to pin a specific mode, you can also set defaultMode directly in settings.
The change with the biggest impact on everyday use is how rules are configured. Customizing Auto Mode's behavior used to require hand-editing a settings file with precise syntax. Now, entries written directly as plain sentences under hard_deny and soft_deny in settings just work:
hard_deny Block unconditionally — regardless of context, they're never allowed throughsoft_deny block by default, but can be overridden by a direct explicit request or a corresponding allow rule$defaults, which keeps Anthropic's built-in default rules in force — your custom rules layer on top rather than replacing themFor example, you can write directly under soft_deny: "Never run database migrations outside the migrations CLI," or under hard_deny: "Never send repository contents to third-party code-review APIs" — no special syntax to learn, just sentences an ordinary person can read. These rules live in your user settings, meaning project-level settings can't override them — particularly important for a team that wants one security policy in force across every project, one that a single repository can't break.
Official documentation also provides several corresponding check commands: claude auto-mode critique tells you which entries in your current rules are ambiguous, redundant, or likely to cause false positives; claude auto-mode config prints the full configuration actually in effect right now; claude auto-mode defaults prints Anthropic's built-in default rules; claude auto-mode reset restores the configuration to defaults. Running critique once before actually relying on a rule set is the more prudent approach.
Making Auto Mode the default effectively shifts security responsibility from "you manually click approve" to "whether you've written a policy in advance." If a team has never customized any rules, that team is currently running entirely on Anthropic's built-in defaults — not a decision they deliberately made themselves. That's worth a team actively deciding on, rather than passively continuing simply because nobody happened to notice.