Claude Code auto mode alone won't tame loops, CoWorker lead says

Ito's account is drawn from daily practice rather than theory. He describes three loop shapes — CI/PR watching, parallel review and implementation, and scheduled overnight batches — and says that when a loop fails, it is almost always because one of six elements was vague: trigger, work, verification, waiting, exit condition, or the point at which a human is brought back in. Verification and human hand-back are the ones most often skipped.

A concrete example comes from writing the article itself. The classifier blocked an attempt to use non-public material in a public piece, and the decision went back to a human, who chose not to use it. Ito notes this shows the hand-back mechanism working, but also cautions that a block this time does not guarantee a block next time. He also describes how a broad instruction to "throw everything away" led auto mode to approve deleting untracked files, wiping the very logs the loop was writing — which is why loop logs and ledgers belong outside the working tree.

The practical stake is where each layer of defense sits. Ito ranks layers by how deterministic they are: classifier judgments are flexible but probabilistic, while permissions.deny and PreToolUse hooks are rigid but certain, and conversation-level approval can vanish when the chat is compressed. Whether a team's loops run unattended without incident is likely to depend on how much of the safety burden it moves down to those deterministic layers, and on whether it keeps a ledger of blocked and reverted actions and feeds them back into hooks.