Why auto mode is not enough for enterprise AI agents
Carlos Lebre Ribeiro ·
Auto mode is a second model inside an agentic harness that decides which actions a person needs to see and which clear on their own. It cuts approval prompts for developers, and it does not give an enterprise evidence it can defend.
What auto mode proves
The vendors’ own numbers make the case for it. Anthropic reports that Claude Code users approve 97% of permission prompts. In its controlled test with 1,053 people, humans caught 13.6% of dangerous commands and the classifier caught 89%.
Approving everything does not scale. Anthropic’s own guidance also says auto mode does not guarantee safety, and that high-stakes changes still need direct review.
Why it cannot live inside the harness
- Self-attestation. The executor is grading its own actions. Regulators and auditors look for evidence from a party that is not the actor.
- The wrong objective. Auto mode optimises for fewer interruptions on a developer’s machine. Enterprise supervision optimises for a decision you can defend.
- Lock-in. Enterprises build model gateways so they can move between providers. A supervision policy tied to one framework changes shape when the gateway fails over.
- Nothing governs the business action. Auto modes govern code. In most agent frameworks, human-in-the-loop is a static gate set at build time, and nothing classifies the risk of this action at runtime.
What an enterprise needs instead
The same collapse in approval volume, with the record that makes it defensible. At a European e-commerce customer in production, human escalations fell from 100% of agent actions to 14% in six weeks, with zero incidents.
The approvals you remove and the evidence you keep come from the same layer, which is why supervision cannot be added afterwards.