Agent Skills: Autonomy

Autonomy

Autonomous mode lets Claude Code execute tasks end-to-end with minimal human-in-the-loop. Safety comes from two things:

1. Profile-scoped permissions — the allow/deny/ask lists match the profile's risk tolerance.
2. Gate agents — planner writes an explicit plan before code, verifier runs checks after implementation, reviewer blocks merge on 10 criteria.

Four profiles

Fetch full profile via cc_kb_autonomy_profile(profile). Summary:

| Profile | Risk | Permissions shape | Gates | |---|---|---|---| | conservative | Minimal | Read-only default; ask on any write | planner + verifier + reviewer (all enabled, 10 block criteria) | | balanced | Default | Free writes in project; ask on network/publish/push | planner + verifier; reviewer optional | | aggressive | High trust | Most tools allowed; deny only destructive | planner only | | unattended-review | Hybrid | Same as aggressive at runtime; reviewer gates commit/push | planner + reviewer |

Three gate agents

All three are installed as regular agents — autonomous mode just wires them into the flow.

1. autonomy-planner (Opus)

When: runs first, before any implementation. Writes: .claude/active-task.md — explicit plan with:

• Constraints and invariants
• Phase breakdown with exit criteria per phase
• Risk assessment and rollback plan
• Verification checks the verifier will run

Hard rule: no code touches disk until .claude/active-task.md exists.

2. autonomy-verifier (Sonnet)

When: runs after each implementation phase. Reads: .claude/active-task.md verification block. Runs: 5 built-in checks (configurable via profile):

• tsc --noEmit (TypeScript projects)
• eslint (JS/TS projects)
• pytest / jest / project test runner
• git diff --stat sanity check
• Secret scanner (trufflehog, gitleaks)

Output: { pass: boolean, failures: [...] }. If pass: false, halt and surface to caller.

3. autonomy-reviewer (Opus)

When: runs before commit/push in conservative and unattended-review profiles. Checks 10 block criteria:

1. Any hardcoded secret
2. Any .env or credential file added
3. SQL injection vector (string-concat queries)
4. XSS / unescaped output in web code
5. Deleted test without replacement
6. Commented-out code larger than 20 lines
7. Dependency added with no justification in commit message
8. Breaking API change without BREAKING CHANGE: footer
9. TODO or FIXME on a security-relevant line
10. console.log / print of sensitive variables

Output: { approve: boolean, blocks: [...] }. Any block = stop.

Session init command

Each profile provides a session_init_command. Example for balanced:

claude --permission-mode acceptEdits --dangerously-skip-permissions=false

For unattended-review:

claude --permission-mode acceptEdits --enable-reviewer-gate

Permission block generation

/cc-autonomy enable <profile> generates a settings.json block:

{
  "permissions": {
    "allow": [ /* from profile */ ],
    "deny":  [ /* from profile */ ],
    "ask":   [ /* from profile */ ]
  }
}

Merges into existing settings.json without overwriting unrelated sections.

Memory rules

Each profile includes memory discipline. Conservative requires saving every decision (including rejected options). Balanced is lighter. Aggressive is the standard engram protocol.

MCP delegation

| Need | Tool | |---|---| | Fetch profile details | cc_kb_autonomy_profile(profile) | | Plan for an unattended task | cc_docs_autonomy_plan(task, repo_signals) | | Model for gate agents | cc_docs_model_recommend(task, budget) |

Anti-patterns

• Running aggressive profile on an unfamiliar codebase → first session should always be conservative.
• Disabling the verifier to "move faster" → regressions ship silently.
• Letting planner skip the risk section → rollback becomes guesswork.
• Custom profile without any gates → not autonomous, just unsupervised.