Every protected operation — writing files, editing files, running commands — either asks for your approval or is auto-approved by the mode you chose. This is the heart of "visible execution, reliable before autonomous".
The three permission modes
Choose in the task composer:
| Mode | Behavior | Best for |
|---|---|---|
| Request approval (request_approval) | Asks before every protected operation | Unfamiliar projects, high-stakes repos, first runs |
| Auto approval (auto_approval, default) | Low-risk operations run automatically; high-risk ones still ask | Everyday development, balancing speed and safety |
| Full access (full_access) | Skips approvals entirely | Sandboxed workspaces you can afford to throw away |
Note: runs triggered by scheduled tasks always use Request approval, so nothing risky executes unattended.
Risk grading
In Auto approval mode, every tool call is assessed first:
- Safe: read-only actions — browsing, searching, reading files — run automatically;
- Low risk: well-scoped, reversible operations;
- High risk: bulk modifications, arbitrary command execution — always asks;
- Unknown: treated as high risk and asks before running.
Decisions are remembered
Your approvals are persisted:
- When a run is recovered after a restart, already approved operations are not asked again;
- Decision records are stored with run history, so you can trace who approved what and when.
Built-in protections
Regardless of mode, these always apply:
- Workspace boundary: file operations and commands are confined to the authorized folder;
- Sensitive path protection:
.env*, private keys (e.g.id_rsa),secrets/, andcredentials/are protected from casual reads or exfiltration; - Ignored directories:
.git,node_modules,dist,.next,targetand similar are skipped by default; - Secret redaction: configured API keys and other secrets are redacted from outputs and checkpoints.
Recommendations
- New or unfamiliar codebase: start with Request approval to observe how the agent behaves;
- Switch to Auto approval once comfortable — let low-risk work run itself and keep control of risky steps;
- Reserve Full access for sandboxed workspaces you can discard at any time.