Yolo Auto Mode Classifier

# YOLO/Auto-Mode Classifier System

> **Observed in**: Claude Code internal architecture
>
> A 2-stage security classification system that determines whether tool invocations should be auto-approved or blocked. This is the core of Claude Code's "auto-approve" mode.

---

## Architecture Overview

The YOLO classifier is Claude Code's **most security-critical component**. When the user enables "auto mode" (previously called "YOLO mode"), this classifier evaluates every tool invocation before it runs.

### How It Works

1. **Base Prompt**: Loaded from `yolo-classifier-prompts/auto_mode_system_prompt.txt` (bundled at build time via `bun:bundle` feature flag `TRANSCRIPT_CLASSIFIER`)
2. **Permissions Template**: Swapped at runtime depending on user type:
   - **External users**: `permissions_external.txt`
   - **Anthropic employees** (`USER_TYPE=ant`): `permissions_anthropic.txt`
3. **User Rules**: Three customizable sections are injected from `settings.autoMode`:
   - `allow` — actions the user explicitly permits
   - `soft_deny` — actions that should be blocked (but user can override)
   - `environment` — context about the user's environment

### Classifier Tool Schema

The classifier uses a forced tool call (`classify_result`) for structured output: