Separate Permission Decisions From Execution Boundaries

Repeated permission prompts can become a reflex. Automating some of those decisions may reduce interruption, but it also changes which actions proceed without a person inspecting them.

Claude Code's auto mode uses a permission classifier. A classifier can make a wrong decision; describing an action as routine does not establish that it is authorized. Inspect the effective permission rules and test both allowed and denied cases on disposable inputs.

A sandbox addresses a different question: what filesystem and network access the process can exercise. Check the actual platform support and configured boundaries rather than assuming that selecting a mode enables containment.

For an unattended workflow, keep the permitted effects narrow, retain the activity record and define what requires human approval. Fewer prompts are an interface improvement, not evidence that the workflow is safe.