Anthropic's auto mode previews the next test for AI governance

The permission prompt is the most reliable control in modern software, and it is failing. Anthropic's Claude Code, an agentic coding tool, has long required a human to approve anything consequential. A new auto mode, reported by WealthTech Today, replaces most of those prompts with an automated classifier that judges what the agent is about to do before it executes. The product is for programmers. The software that eventually sits inside an RIA's stack is the real subject.

Claude Code reads files, writes code, runs commands and completes multi-step assignments on its own. That autonomy forced Anthropic to decide how much authority to give it. Auto mode is the decision: a machine-level reviewer between the agent and the action, making the call a human used to make.

The data in the WealthTech Today report explain why the human checkpoint had to go. Users approve 97% of permission prompts. Sixty-two percent have either used the bypass-permissions feature or told the tool to stop asking about Bash commands. A quarter of interactive sessions start in bypass mode. This is not careless behavior. It is people adapting to friction. After 49 correct answers, the next prompt goes unread.

The report also describes an Anthropic test. There, 1,053 paid professional testers had a dangerous command inserted into the approval flow. Humans caught it 13.6% of the time. The automated classifier caught it 89%. People blocked about 17% of dangerous commands early in a session. After 50 or more prior prompts, the figure fell. It settled at roughly 5%. The more the tool was trusted, the less the human watched.

For an RIA, the coding product matters less than the architecture. The report positions auto mode as a preview of the control model firms will need once AI agents operate directly inside wealth management technology. An agent that drafts a client update can someday send it. Rebalancing software that suggests trades can someday execute them. The approval fatigue that hit programmers will hit advisors and support staff, with client money attached.

Installing a classifier to watch the software would be the wrong lesson. The right one is to write the exception rules before the machine arrives. A firm should know ahead of time which actions are routine enough to run without review, which need a rule-based check before execution, and which require a named human's sign-off after the fact. Firms that build these workflows for today's repetitive tasks — small transfers, address changes, routine disclosures — are rehearsing for the agent era. Firms that rely on staff vigilance across hundreds of daily approvals are betting on the late-session catch rate. That rate was about 5%.

The advisor's job does not disappear. It moves up a level. The person who used to approve the 200th routine request becomes the person who writes the rule that handles it, judges the edge cases and owns the exceptions. That is a modest shift in title and a large shift in accountability, and it will take shape in client communications before it reaches the trade blotter.