diff --git a/CLAUDE.md b/CLAUDE.md
index 4660df5..d960f8e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -26,3 +26,16 @@ Simple file-sharing platform. TypeScript + Fastify + SQLite.
 - Break large functions into smaller ones, extract duplicate code.
 - Search for duplicated code in tests and extract into reusable helpers.
 - Commit after every logical set of changes. Keep commits small and focused.
+
+## Autonomous Commits (Standing Authorization)
+
+Any Claude Code instance working on this project has standing authorization to commit work without asking. Apply this proactively, not when reminded.
+
+- After every logical set of changes that builds and tests cleanly (`npm run build && npm test`), create a commit immediately. Do not wait for the user to ask.
+- Use Conventional Commits (`feat:`, `fix:`, `refactor:`, `docs:`, `test:`, `chore:`, `perf:`, `ci:`) with a concise subject. Add a body only when the *why* isn't obvious from the diff.
+- One logical change per commit. If you touched multiple unrelated things, split into separate commits.
+- After committing, also push to the tracked remote (`git push`) — standard `git push` to the current branch's upstream is authorized. **Never** force-push (`--force`, `--force-with-lease`) and **never** push to `main` from a feature branch directly without an explicit request.
+- **Never** stage `.env`, `data/`, secrets, or anything matching a credential pattern. Prefer `git add <specific files>` over `git add -A`/`git add .`.
+- If the build or tests fail, do **not** commit. Fix or revert, then either commit a working state or report the failure.
+- Skip the commit if there are no changes (don't create empty commits).
+- If you find yourself amending or rewriting prior commits, stop and ask first — autonomy covers new commits, not history rewrites.