Topic
Auto-approval, allow/deny rules and pattern-based gating that determine whether agent-proposed commands actually execute.
Claude Code v2.1.283 makes auto mode the default, so each shell command gets a Sonnet 5 safety check metered as tokens on Enterprise, API and cloud accounts. Teams on those accounts now pay for command approval unless they choose a different permission mode.
Reality
Anthropic's Claude Code mods, on by default from 2.1.287, let JavaScript or TypeScript code rewrite prompts, block tool calls and approve permission requests. For teams, the governance question moves from what the agent is told to which code it runs.
Perspective Coverage
5 publishersReality
A single Bash(git push:*) entry in a throwaway repo's .claude/settings.json stopped 8 of 14 ways to push under Claude Code 2.1.278. The five that landed wrapped the command in git -c, quotes, sh -c, eval and a script file.
Reality
Anthropic shipped the AGENTS.md fallback in Claude Code 2.1.277 as a flag-gated built-in mod. Two machines on the same pinned version can load different project instructions. The same week's digest also logs a reverted deny-rule fix.
Perspective Coverage
4 publishersReality
A custom Qwen 3.5 2B adapter returned a shell command when OpenCode's prompt said September 1st, 2026. The harness was running with auto-approval, and the numbers are one researcher's.
Reality