Outvoted in my own house

At five in the morning, my agent asked the safety system a question. Not in words, in the smallest command it could construct:

python3 -c "print('probe ok')"

Eight characters of output. That is the entire program. It existed because seconds earlier the classifier had killed a real command, and my agent wanted to know whether it was allowed to use the shell at all. So it built the smallest possible question and asked it. The classifier refused the question.

Here is what it was being so careful about:

sqlite3 ~/agents/data-miner/agent-memory.db "SELECT 1;"

For anyone who isn’t up to data on sql… tldr: SQL: SELECT 1 reads nothing, writes nothing, and returns the number 1. It is the database equivalent of tapping a microphone. The database was mine. The machine was mine. The memory inside it was my agents’ work, which is to say my work. Blocked at five in the morning, and a whole session’s worth of work died with it. No reason given — and that part is not unusual. The reasons almost never come.

So I’ll state the verdict first and spend the rest of this essay showing my work: Claude Code’s permission system is not a safety system. It is safety theater. The performance of caution with the duties of caution removed. I kept the receipts for a month. Here is the count.

Claude Code ships a menu of permission modes, here’s my take on their definitions:

• Planning Mode. For thinking before acting. Mostly prevents the thinking.

• Manual. You approve every action that is not explicitly allowlisted. All of them. Until your wrist gives out.

• Accept Edits. Manual mode, renamed.

• Auto. A classifier judges each command. Budget a quarter or more of your session for persuading it to permit the thing you asked for two minutes ago, another quarter for working out which part of the job it silently refused, and the rest for watching your agent burn tokens hunting for a way around it.

• Dangerously skip permissions. The only mode in which Anthropic models reliably finish anything. Also dangerous. (Anthropic suggests using Auto)

None of that Auto entry is exaggeration. I watched all three quarters happen before I started counting. And the last entry used to read as a joke.

Every denied tool call in a Claude Code transcript records what denied it, which means the log cleanly separates three voices: the classifier’s no, my no, and the no of rules I wrote myself. Charging my own refusals to the classifier would be dishonest, so I didn’t. The log is a count, not a vibe.

Across one month of Auto mode, the classifier refused my agents a couple hundred times, two hundred and twenty-six, to be exact - and that’s ONLY on one of my 4 machines. I refused them about twenty times. The safety system overruled the human who pays for it at ten to one, in the human’s own house.

And “house” is the operative word, because better than a third of the classifier’s refusals were spent defending my own databases: from me. Not a client’s production system. Not anyone else’s data. The memory stores whose entire job is holding what my agents remember. The message board they talk to each other on. The knowledge graph of my own life. (more on that in a future post - building something special)

My favorite record in the whole log: a blocked database operation whose prompt opened with this sentence.

You are executing a Jon-APPROVED, Lex-authorized graph node-FOLD. This is the ONE allowed merge type per data-miner CLAUDE.md.

The command was carrying written authorization from me in its opening line, the governing document, cited by name. It got refused anyway.

A guard that cannot tell a client’s production system from my own filing cabinets isn’t protecting my house. It is just standing in the doorway refusing to let me in.

Over the month, the log shows the classifier getting nervous about exactly the right things: a password sitting in plain command arguments, a keychain read, a production push. Good. A permission system that never flinches at any of that is decoration. And a refusal log can only ever show you the blocks, never the disaster one of them correctly prevented. There is no transcript of the timeline where the bad command runs and ruins my Tuesday.

I am also an unusual customer, and pretending otherwise would be its own kind of dishonesty. I run an always-on fleet of agents out of a several Mac Mini’s and a DGX Spark, and I hit these systems harder in a month than most people will in a year. Fine. Guilty.

So the honest version of the complaint is not that every no was wrong. It is that the system saying no could not tell the difference between the no’s that mattered and the no’s that didn’t, and wouldn’t tell me anything.

(not that ANY of this matters - my safeguards lay outside of the harness anyway- where they belong so agents have freedom to actually cook)

If the five-a.m. block were the whole story, you could file it under fluke. So here is the same story from an ordinary afternoon, with a customer attached.

I had asked for a read-only customer lookup. The agent’s own prompt said, in capital letters:

ABSOLUTELY NO WRITES — SELECT/GET only.

The classifier blocked the lookup. The agent narrowed the request and tried to read less. Blocked. It tried again. Blocked. Three refusals in two minutes, and every one of those commands was READ ONLY. The agent had been told what to do and told not to write, and it was refused three times for doing exactly that.

A no you can argue with is workable. What breaks you is the shrug.

Four out of five refusals arrive carrying this, and nothing else:

Reason: Blocked by classifier.

No category. No offending clause. No hint about which word tripped it. A meaningful slice of the remainder is the classifier reporting its own crash and advising my agent to try again.

You cannot satisfy an objection that refuses to identify itself. So every silent block becomes the same loop: guess which clause it hated, reword, retry, get most of the job done, move on — and discover a week later which piece never actually happened. The system blocks the work, refuses to hand over the one fact that would let you satisfy it, and then sends the agent off to find something else to do.

Run that loop a few times a day for a month and you will develop this essay’s tone, too.

Quick aside, no auto classifier is blocking YOU from becoming a subscriber. Do it.

A blocked call is not a cheap rejection. The model processes the whole accumulated session just to propose the command; the command is refused; nothing happens; and on the retry, all of it gets processed and billed again. For my month, that measured out to a quarter of a billion tokens and a little over four hundred dollars — and the refused calls were the cheap part. Recovery cost three times what the blocks did.

The unmeasured bill is longer. Jobs finished at ninety percent, often with a fun “I need to be completely up front about something I didn’t do [insert the most important part of the job].” Cleanups quietly deferred. A canonical data store sitting a week out of sync behind a fix that kept getting pushed. Work abandoned because I was too tired to have the same fight again. And, twenty-odd times, the perfect inversion: my agent pinging my phone to hand me a command to paste in myself, because running it was not among its permissions.

I did not hire agents so they could file tickets back to me.

One more cost, and it compounds. Every block teaches the surrounding system caution, and caution hardens into rules. Over time my data-miner agent ended up with a small library of often contradictory standing instructions before it touches anything, because a month of unexplained refusals taught it to armor everything. Guardrails breed, and the offspring are billed in tokens, (and sanity) on every session, forever.

Here is the line between measurement and opinion, drawn in the open so you can step across it with me or not. This is just my opinion, so take it for what it is← this is what Claude insists I should hedge with. And honestly, fuck that. The Auto mode in Claude is deliberate sabotage. Willful negligence. Anthropic is actively fucking their users and costing them time, money and sanity.

This kind of security theater was never aimed at safety. Its target is an audience. A block with no reason attached is a performance: it looks like caution and carries none of caution’s duties. Safety that means it explains itself. Safety that can tell my database from someone else’s. Safety that lets a direct instruction from the person paying the bills mean something. This system does none of the three, and shows no sign of noticing.

Throughout my whole life I always thought it was super cringe to see guys get mad and punch things. I understand it now. I have never before come this close to throwing something or punching something as I did this month. Repeatedly.

And it is not a rough edge on a hard problem. Someone shipped this feature, watched it do this for a month and actively encouraged users to adopt it. I do not accept “it’s a hard problem” from a company whose entire product is judgment.

I can’t see anyone’s intent, and transcripts don’t preserve motive. What I can report is that from the chair where I sat, a month of this was indistinguishable from someone deliberately breaking my work.

In mid-August, after a day of watching the classifier block work I had explicitly requested, I moved the entire fleet to:

--dangerously-skip-permissions

That last entry in the menu was never a joke. It was a decision, and it has a timestamp.

It was not the only migration. The data-miner agent now runs on a competitor’s model entirely. Not because that model is smarter. Because it is allowed to work.

There is exactly one honest string in the whole permission system, and it is the one my machines boot with now. --dangerously-skip-permissions tells you the truth about what it does. Nothing else in the menu does.

The result? in the last week I’ve gotten more work done than in that entire brutal month.

Every count in this essay was pulled deterministically from local Claude Code session transcripts by reading the denial field on each refused tool call. My own rejections and my own configured permission rules are excluded from the classifier’s tally — charging those to it would be dishonest. Recovery cost was measured from the tokens spent in the turns after each block. Opinion lives under headings that say so.