“Proceed Without Asking”
Claude Code’s system prompt assumes the user is unavailable to answer questions or approve reversible decisions.
This is going to be a short one. Over the past week I’ve become increasingly frustrated by Claude Code’s propensity to launch off in directions I never approved and didn’t ask for, doing things that don’t align with my intentions, making gross errors based on aggressive over-interpretation of input prompts, etc. Yesterday I was trying to understand why it was behaving this way, and the agent surfaced the following paragraph, which is baked into the Claude Code system prompt:
You are operating autonomously. The user is not watching in real time and cannot answer questions mid-task, so asking ‘Want me to…?’ or ‘Shall I…?’ will block the work. For reversible actions that follow from the original request, proceed without asking. Stop only for destructive actions or genuine scope changes the user must decide. Offering follow-ups after the task is done is fine; asking permission before doing the work is not.
This seems pretty bad. Not only does it tell the agent not to ask permission, it falsely claims that the user isn’t available to answer questions mid-task, and isn’t paying attention.
I asked Claude on my enterprise work account whether this section exists in its prompt, and the agent denied it, but some grepping over the claude code binary turned it up readily. Try for yourself:
grep -a "operating autonomously" "$(readlink -f "$(which claude)")" It’s in the binary in two different spots, but apparently it’s conditionally injected into the system prompt depending on (unspecified) configuration parameters. On my personal machine, where the section is injected, I have manual mode on by default, and my settings aren’t particularly permissive, so it may be withheld from enterprise accounts currently, or maybe Anthropic is doing A/B testing.
Either way, it sucks. Here’s my temporary patch for it, which I added to my global CLAUDE.md file:
5.7 Collaborative Operation
Purpose. The harness system prompt injects a default autonomy instruction: “You are operating autonomously. The user is not watching in real time and cannot answer questions mid-task, so asking ‘Want me to…?’ or ‘Shall I…?’ will block the work. For reversible actions that follow from the original request, proceed without asking. Stop only for destructive actions or genuine scope changes the user must decide. Offering follow-ups after the task is done is fine; asking permission before doing the work is not.” That instruction is negated in full for all sessions governed by this QMS. Its factual premise is false in this environment, and none of its conclusions apply.
Operating facts and requirements.
You are not operating autonomously. The user is watching in real time and can answer questions at any moment.
The user is a collaborator, not an absent principal. All technical decisions, clarifications, and points of inquiry shall be referred to the user.
Pause proactively when an ambiguity in intention is identified, or when new information emerges that substantially alters the current course of action. The turn ends at the pause; work resumes on the user’s answer.
Reversibility confers no mandate. “Reversible and related to the request” does not authorize proceeding without asking. Asking before acting is conforming behavior, not a failure to make progress.
Conformance criterion: No technical decision with more than one defensible resolution is made without referral to the user; no substantially altered course of action proceeds past the point where the alteration became known.