Claude cannot grant itself permissions - settings edits are hard-blocked as self-escalation

Even with the user explicitly saying add the permission rules yourself in chat, the auto-mode classifier hard-blocks Edit calls that modify permissions in ~/.claude/settings.json - self-escalation is a security boundary user intent does not clear, distinct from soft blocks that intent can clear. The escape hatches are user-executed: the /permissions UI, or handing the user a one-shot python/jq edit command to run via the ! prefix (which executes as the user, unclassified). Also useful: a tool allow-rule (e.g. Bash(aws:*)) does not exempt commands from the auto-mode classifier - the two are separate layers, and compound commands mixing allowed and unallowed tools get classified as a whole.