feat(autonomy): cut permission prompts and guard denials that interrupt autonomous lanes #5993
Description
Autonomous work should run without permission prompts and with as few auto-mode or guard denials as possible; today a single session hits several, each costing a retry.
The owner's words (interview for #5958): "I need the least amount of friction when I'm specifically like, 'Hey, go get work done.' I don't want to see permission prompts. I don't want to see auto-load denying. I just need that stuff to work smoothly."
Observed in one session (PR #5958, 2026-10-02/03)
| Denial | Source | What the session did instead |
|---|---|---|
Inline python3 - <<EOF that writes a file |
guardrails block-hook-bypass |
Re-did the edit with the Edit tool |
printf ... >> file into a git-ignored .work/ file |
guardrails block-hook-bypass (only listed scratch roots are exempt) |
Edit tool |
Multi-line git commit -m |
guardrails block-noncanonical-commit |
git commit -F - <<'EOF' |
A for loop or bash -c that contains gh or git |
worktree-isolation guard ("too complex to verify") | Split commands, or a script file in the scratchpad |
cd inside bash -c before a repo script |
worktree-isolation guard | Ran from the session cwd |
Each denial is correct on its own terms; together they make an unattended lane slower and more error-prone, and a lane that cannot retry stalls.
Proposed
- Measure first: which prompts and denials lanes actually hit, how often, by source (hook, classifier, permission rule), from lane telemetry (
/harness-ops:observability) and session transcripts. - For each frequent one, decide: keep the guard and give the canonical alternative in its message (several already do), widen an exemption (for example, the
.work/memory slice as ablock_hook_bypass_scratch_rootsentry), or add an allow rule (/harness-config:audit-permission-grants,/harness-config:draft-auto-mode-rules). - Never bypass mode or
--dangerously-skip-permissions(AGENTS.md): lanes read untrusted text while holding push credentials. Merge authority stays a separate track (babysit-loop: wire inline promotion evidence into the CI pr-merge lane #4588).
Related
- babysit-loop: wire inline promotion evidence into the CI pr-merge lane #4588: autonomous merging, the other half of "go get work done".
- disk-hygiene: run files under ~/.claude are protected-path writes that no allow rule can pre-approve #4225 and Cloud sessions compose no permission floor: standards claude-permissions (allow AND deny) is never applied #3172: other permission-floor gaps.
🤖 Generated with Claude Code
Metadata
Metadata
Assignees
Labels
Type
Fields
No fields configured for Feature.
Activity
kyle-sexton commentedon Oct 3, 2026
Triaged: type Feature,
priority: high,work-class: read-onlyfor step 1.agent-readyyet: step 2 needs the step-1 data before any guard or permission change is briefed. Step 3 (never bypass mode) stays a hard constraint.kyle-sexton commentedon Oct 13, 2026
Owner batch-ratified this admission in an attended session on 2026-10-12: work-class: read-only. Rule: class C1-C3, no trust surface, the independent check confirmed the recorded decision, and no owner step remains.
kyle-sexton commentedon Oct 14, 2026
kyle-sexton commentedon Oct 14, 2026
Step 1 results: which denials and prompts lanes hit
Picked up autonomously by
/work-items:work-loop(admitted, read-only class). Measured with/session-flow:audit-friction'sfriction.py mineover theaudit-sessionsstore, 2026-10-07 to 2026-10-14, this machine only.Scope. 1,105 sessions in the window; 856 run under
/tmp(plugin-eval and test sandboxes) and are excluded. Their largest row, 641denied/rule/modeBash denials, is the sandbox's permission mode, not lane friction. What remains: 249 sessions (185 automated, 64 interactive), 201 active hours, 1,358 denials.cat >,echo/printf >, python inline write)block-hook-bypassblock-root-delete-targetgit commit -mblock-noncanonical-commitblock-hook-bypasssubcommandResults,safetyCheck, rule)Classifier, by category: Merge Without Review 61 (merge authority, #4588), Irreversible Local Destruction 15, External System Writes 16, Security Weaken 11, Unrequested Commit in a Connected App 11, Security Test Removal 9, Self-Modification 7, Auto-Mode Bypass 6, other 64.
Permission prompts the person approved: 153, 105 of them inside subagents; 56 are subagent
WebFetch learn.microsoft.com. Agent-side asks and hand-offs (not guard or permission friction): 138 asks, 71 hand-offs, 172 "approve" replies.Findings
block-hook-bypassis about 64% of all denials, almost all in subagents, where a denial costs a retry with no person to help. In the retained event sample (capped; row counts above are complete), about 30% of these writes target the repo's gitignored.work/and about 25% the session scratchpad or/tmp.S=<scratchpad>; cat > $S/f). Filed fix(guardrails): resolve a same-command literal VAR=/path before judging write and delete targets #7413 to resolve a same-command literal assignment in both this guard and the delete guard..work/is deliberately not exempt (plugins/guardrails/hooks/block-hook-bypass.shlines 544-556: the secret scan covers Write to.work/, so exempting Bash redirects there would bypass it). fix(guardrails): narrow or retire block-hook-bypass now that shell file changes are checked #6689's narrowing keeps gitignored targets blocked, so the.work/share stays unless the content scan can run after the write on gitignored paths. That design question belongs on fix(guardrails): narrow or retire block-hook-bypass now that shell file changes are checked #6689.WebFetchprompts onlearn.microsoft.com(56) come from a user-scope allow gap. That is the owner's config, applied through the built-in/fewer-permission-prompts; nothing was changed here.subcommandResultsrule denials cluster oncd <dir> && git ...compounds. The worktreegit -Cconvention already avoids these; no new item.gh issue commentheredoc because the body quoted a variable-target delete. 0.51.0 already treats a quoted-delimiterghheredoc body as data (fix(guardrails): block-root-delete-target judges backticks inside a quoted heredoc body #6625), so the session was on a stale plugin cache.Raw data stays local in
.work/5993-friction/(it holds session excerpts, so it is not attached). Re-measure after #6689, #6464 and #7413 land:/session-flow:audit-friction remeasure.Step 2 for the remaining rows is on the linked items. This item's step 1 is done.
🤖 Generated with Claude Code
kyle-sexton commentedon Oct 14, 2026
Done (2026-10-13): Step 1 delivered: denials and prompts measured by source and frequency over 249 non-sandbox sessions (2026-10-07 to 10-14); table and findings in the comment above. block-hook-bypass is about 64% of 1,358 denials, nearly all in subagents. Step-2 changes are tracked on #6689 (narrow block-hook-bypass), #6464 (multi-line commit guard), and #7413 (new: resolve same-command literal VAR=/path targets). No PR: read-only work class.