Claude Code auto-mode classifier sits above permission allow rules

An existing Bash(aws:*) allow rule did not stop auto mode from denying compound commands. Denied commands included eval of exported credentials, for/while loops around allowed commands, ECR login with piped credentials, git reset --hard, and launching a bulk publishing script. Self-edits to permissions in ~/.claude/settings.json were denied even after the user said in chat to make them. The working route was for the user to add rules through /permissions or run the step with the ! prefix. After that, single commands matching the rule prefix ran, and polling worked as single aws calls plus the Monitor tool. Don't keep re-slicing a denied production step; hand it to the user with the exact command.