How do I let Claude Code run unattended for hours without approving every command?

The prompt was never the control#

Developers click yes on 93% of permission prompts. That's Anthropic's number, from its engineering write-up on auto mode: "in practice users accept 93% of them anyway."

Anthropic also ran a study with 1,053 testers. Human review caught 13.6% of dangerous commands, per its auto mode announcement.

So the prompt costs your developers their attention and still misses most of the dangerous commands. You can drop it, but only if something else takes its place.

Unattended runs need a check that doesn't need a person#

An agent session averages 145 actions, and long ones run past 1,000. Nobody reads 1,000 prompts. Somewhere along the way, they start hitting enter without looking.

For a run that lasts hours, software has to make the decision. It has to decide before the action runs, and fast enough that the agent never idles.

Bypass mode belongs in a throwaway box#

Claude Code's docs say to use bypass mode only in isolated environments "like containers, VMs, or dev containers without internet access, where Claude Code cannot damage your host system."

Take that literally: a throwaway container with no credentials worth stealing and no route to production. A developer laptop with SSH keys, cloud profiles and a logged-in gh doesn't qualify.

Why allow-lists keep growing#

The usual middle path is an allow-list. You pre-approve npm test, git status and docker compose up, and it works for a week.

Then the agent needs a new command, someone clicks "don't ask again," and the list grows. Nobody prunes it. Each entry trusts the command's pattern every time, whatever the command does on a given run.

The same command can be harmless in one session and dangerous in the next. curl fetching docs and curl posting an env file are both curl.

What each built-in option does and doesn't stop#

• Permission rules (allow, ask, deny): good for hard lines like "never read .env." They match the command's text and don't know what the session is trying to do.
• Auto mode: Anthropic's answer to prompt fatigue, now the default in Claude Code. It covers Claude Code only.
• Sandboxes and containers: limit the blast radius. They can't tell you whether an action inside the box was the one you wanted.
• Hooks: a pre-execution hook runs before a tool call executes and can block it. That's the right place for a check, but the hook only blocks what the check behind it tells it to block.

A decision rule#

• Throwaway container with no secrets and no internet? Bypass mode is fine.
• Laptop or shared dev box? Don't use bypass mode.
• Want hours of unattended work on a laptop? Replace the human click with a policy check at the hook.
• Running Claude Code, Codex and Cursor side by side? Put the check outside any single agent, so one policy covers all of them.

Where Harden fits#

Harden Agentic Integrity Foundation (AIF) is a check that runs at that hook. It sits on the developer laptop, outside the agent. Every command, file edit and push is checked against the session's intent before it runs.

Decisions are made locally in about 28 ms (P99 about 70 ms), so the agent doesn't wait. Nothing leaves the machine. When Harden blocks an action, the agent gets the reason and can retry a safe way, so the session keeps going without a person.

Security gets one policy across every agent, pushed by the MDM you already run, and every decision is recorded. AIF starts watch-only, so you can see what agents do before you enforce anything.

It's a layer, not a perimeter. It doesn't replace least privilege, scoped credentials or egress policy. See what to check before approving Claude Code and stopping destructive commands.

What to ask for before approving long runs#

• One policy that applies the same way to every agent.
• A record of every action and the decision made on it.
• A fail-closed default: if the check can't run, the action doesn't run.

Say yes to agents that run for hours. Just don't make a person approve every action.