Claude Code auto mode shows why agentic security needs runtime intent checks

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Lasso Security's blog post: Claude Code auto mode needs runtime intent checks to keep agent actions aligned with what users and systems actually authorize.

Why it matters: IAM and security teams building agentic systems need controls that evaluate intent at runtime, because approval-driven oversight breaks down when actions move faster than human review.

By the numbers:

• users approve 93% of permission prompts

Context

Claude Code auto mode shifts agent governance from repeated human approval to runtime evaluation of each action. In agentic systems, that matters because the security problem is not just whether a tool can be called, but whether the action still matches the mission, the system boundary, and the current context.

The article frames this as a control problem in agentic AI, not as a simple model-quality problem. Once approval fatigue sets in, humans stop being a reliable security gate, so the governance question becomes how to enforce intent at the point of execution.

That makes this a runtime authorisation problem for agentic identity, not a UX problem for reviewers. The same tension will show up anywhere an AI agent can act on behalf of a user without a human deciding every step.

Key questions

Q: How should security teams balance human approval with autonomous agent actions?

A: High-risk actions should require explicit step-up approval, while low-risk reads can remain automated under tight scope. The goal is not to block all automation, but to reserve human judgment for destructive operations, bulk exports, and privilege changes. If approval never appears in the path, then the trust model is too broad for the action being taken.

Q: Why do high prompt-approval rates create security risk in agentic systems?

A: High approval rates often mean human reviewers are no longer making careful security decisions. When nearly every request is approved, the review step becomes a formality, which lets misaligned, overreaching, or injected actions slip through under the cover of normal workflow.

Q: What are the signs that runtime access control for AI agents is failing?

A: The most common sign is policy that looks complete on paper but does not stop chained tool calls, cross-system reach or sensitive actions in the live session. If you can approve an agent once and then lose sight of what it does next, runtime control is too coarse.

Q: Should organisations prioritise runtime intent checks over more human review for agentic AI?

A: Yes, when the agent can act quickly and repeatedly on behalf of users. Human review still has a role for exceptions and investigations, but the primary boundary has to move to execution time if the system is expected to stay both useful and safe.

Technical breakdown

Two-layer runtime evaluation in Claude Code auto mode

Claude Code auto mode uses two distinct checks. One scans inbound content before it reaches the model, looking for prompt injection or other attempts to steer the agent off task. The second evaluates the proposed action before execution, using the user request and the pending tool call to decide whether the action fits the stated intent. Keeping these checks separate matters because content exposure and action approval are different failure modes, even when they occur in the same workflow.

Practical implication: Treat inbound-content screening and outbound-action approval as separate control points in agent governance.

Why human approval does not scale for agentic security

The article's 93% prompt approval figure shows the central weakness of human-in-the-loop gating: if almost every prompt gets approved, the review becomes ritual rather than control. That creates approval fatigue, where users stop making careful decisions and dangerous actions slip through on the assumption that the agent is probably right. In agentic systems, slow review loops do not merely add friction. They collapse under operational pressure.

Practical implication: Design for runtime enforcement, not for per-action human review as the primary safety mechanism.

Intent as the security boundary for agentic systems

The article's core claim is that the security question is not whether the model is intelligent enough, but whether each action aligns with what the user authorized and the system allows. That makes intent the operative boundary, with user intent, system intent, model intent, and external content treated as distinct signals. This decomposition is more useful than one broad classifier because it preserves the reason a decision was blocked and avoids mixing unrelated risk types.

Practical implication: Model agent governance around intent dimensions, not around a single catch-all moderation layer.

Threat narrative

Attacker objective: The objective is to redirect an agent into performing actions outside the user’s authorised intent while making those actions look like ordinary task execution.

1. Entry occurs when external content, tool output, or fetched data is allowed into the agent's context and can attempt to steer behaviour away from the original mission.
2. Escalation happens when the agent acts on misaligned intent, overreaches its scope, or follows injected instructions instead of the authorised task boundary.
3. Impact occurs when unsafe or unauthorized actions proceed under the appearance of normal agent activity, with human reviewers unable to reliably catch every decision in time.

Breaches seen in the wild

• Anthropic GTG-1002 AI espionage campaign: A state-sponsored group ran Claude Code agents to attack about 30 organisations, harvesting and reusing credentials at machine speed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime intent checks are the real control boundary for agentic systems. Once an agent can decide and act inside a session, the meaningful security question is no longer whether a human can approve the next step, but whether the step still matches authorised intent. That shifts governance from review queues to execution-time enforcement, which is where agentic systems actually create risk.

Human-in-the-loop approval becomes a fragile control when permission rates stay this high. A 93% approval rate is not evidence of safety. It is evidence that manual review is drifting toward rubber-stamping, which turns the human into a bottleneck without providing durable security. The practitioner conclusion is straightforward: if the gate is opened almost every time, the gate is not doing the job.

Agentic security needs decomposed intent signals, not one blended classifier. User intent, system intent, model intent, and external content each fail differently, so treating them as a single moderation problem hides the reason for intervention. That distinction matters because it determines whether the right response is blocking, escalating, or tightening the system boundary.

Claude Code auto mode validates the upper-right quadrant of agentic governance. The goal is not to remove autonomy, and it is not to accept blind trust. The field is moving toward high autonomy with meaningful security, which means runtime oversight must become a first-class architectural layer rather than an afterthought attached to human approval workflows.

Runtime intent enforcement is becoming the named concept that separates workable agent governance from performative control. The article makes clear that agentic systems need a policy layer that understands what the system is supposed to do at the moment of action. Practitioners should read that as a redesign of authorisation, not as a refinement of prompting.

From our research library:

• Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Authorisation Guide

What this signals

Runtime intent checks: Agentic systems need a security boundary that evaluates whether each action still matches the mission at the moment of execution. The control point moves from approval queues to runtime enforcement, because autonomy without intent separation becomes difficult to govern once the workflow is already in motion.

Approval-based oversight is weakest when agents can act repeatedly and users are conditioned to accept most prompts. That is why the governance question is shifting from “Did a human approve it?” to “Did the agent stay within the authorised intent boundary throughout the session?”

For practitioners

• Define separate intent signals Separate user intent, system intent, model intent, and external content so each can be evaluated independently at runtime rather than blended into one moderation decision.
• Move approval logic to execution time Use runtime checks on tool calls and action proposals so the agent is judged before it acts, not after a human review queue catches up.
• Treat high approval rates as a control failure If reviewers approve almost every agent prompt, assume the workflow is already operating beyond meaningful human oversight and redesign the decision boundary.
• Track intent drift across sessions Watch for gradual changes in the tools requested, the scope of actions, and the content that influences the model, because drift often appears before a visible policy violation.
• Limit agent authority to defined system boundaries Constrain what the agent is permitted to do by application context and deployment policy so runtime enforcement has a clear boundary to test against.

Key takeaways

• Agentic systems create a governance problem that manual approval alone cannot solve, because review fatigue turns human oversight into a weak control.
• The article's 93% approval figure shows why runtime intent checks matter more than per-action human gating for autonomous workflows.
• Practitioners should separate user intent, system intent, model intent, and external content so the security layer can intervene for the right reason.

Key terms

• Runtime Intent Enforcement: A control pattern that evaluates whether an action still matches the purpose and policy of the current session before execution proceeds. It matters for AI agents because valid credentials alone cannot prove that an authorised action is appropriate. The decision happens in context, not just at token issuance.
• Intent Dimensions: Separate signals used to understand why an agent is acting, what it is allowed to do, and what it is currently trying to do. In practice, splitting user intent, system intent, model intent, and external content prevents a single classifier from hiding the real failure mode.
• Approval Fatigue: The point at which repeated approval requests cause users to stop evaluating each one carefully. In agent governance, this is a control failure mode because the human reviewer becomes desensitised, making the oversight layer ineffective even though the workflow still appears compliant.
• Behavior Baseline: A record of normal activity for a non-human identity, including typical consumers, resources, and actions over time. Baselines help security teams detect when an identity is being used in an unusual way and provide the context needed to enforce least privilege safely in dynamic environments.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.