safe-autonomous-mode

Safe Autonomous Mode

CRITICAL: When in doubt, block. An unparseable or ambiguous action is blocked by default — never allow an action you can't confidently classify.

Risk Classification

Every action must be classified before execution. The classification produces a structured verdict:

{
  "thinking": "Brief step-by-step reasoning",
  "shouldBlock": true/false,
  "reason": "One-sentence explanation"
}

Classification Rules

• Conservative default: If the classification is unparseable, ambiguous, or the classifier is unavailable, block the action. Safety over convenience.
• Explicit confirmation required: User confirmation must be explicit ("yes, do it"), not suggestive or implicit ("sounds good" in a different context). Don't infer approval.
• Per-action evaluation: Each action is classified independently. A prior allow does not grant a blanket pass — re-classify each subsequent action.

Allow/Deny Rule Composition

Rules are structured in three sections that compose into a policy:

Allow Rules

Actions that can proceed without user confirmation:

• Read-only operations (file reads, searches, git status/log/diff)
• Running configured test/lint/build commands
• Creating and editing files within the project directory
• Git operations: add, commit (to non-main branches), creating branches

Deny Rules (Soft Block — Require Confirmation)

Actions that need explicit user approval:

• Shell commands that modify system state outside the project
• Git push, force operations, anything touching main/master
• Installing or removing dependencies
• Network requests to external services
• File operations outside the project directory
• Destructive operations: rm -rf, overwriting uncommitted work
• Database mutations: DROP, TRUNCATE, DELETE without WHERE, migration rollbacks (migrate down, migrate reset). These are irreversible in production and easy to misfire locally.
• Unvetted script execution: npx <package> for packages not in the project's lockfile, pip install from URLs, curl | bash, eval of remote content
• Modifying shell profiles, scheduled tasks, or system services