1 question
Auto mode reads its `autoMode` config from user, project-local, and managed scopes; the classifier ignores `<repo>/.claude/settings.json`. Roll out via enterprise managed settings (the only layer developers cannot weaken) and write rules as prose, not as `Bash(...)` patterns.