Every chat runs in one of four permission modes. The selector sits in the composer, next to the send button, and applies to that chat only.
| Mode | What it means |
|---|---|
| Plan | Read-only. The agent explores and proposes a plan. Nothing is edited or run. |
| Ask | Ask before edits and actions that leave the workspace. This is the default. |
| Auto | Workspace edits run on their own. Actions that leave the workspace still ask, except for a narrow set a model reviewer may approve for you — see Automatic approvals in Auto. |
| Allow all | Everything runs without asking, in this chat only. |
New chats start in the mode you last chose. A fresh install starts in Ask.
What "leaves the workspace" means
Every tool the agent can call carries one of three classes, fixed in the code rather than configured:
- Read-only — reading an attached document, listing a directory, listing connected folders, asking you a question.
- Workspace — writing into the agent's own sandbox workspace, importing a file from a connected folder, writing an output back into one.
- Sensitive — running a command, searching the web, fetching a web page, starting a background agent, publishing a local app, and every tool from an external MCP server.
Read-only calls never ask. Workspace calls ask only in Ask. Sensitive calls ask in Ask and in Auto — with the exception below — and are the whole reason Allow all exists.
One exception outranks the mode: replacing a file that already exists in a connected folder always asks, including in Auto and Allow all. Creating a new file there does not.
Automatic approvals in Auto
Auto does more than let workspace edits through. A small, cheap model reviews a narrow set of sensitive calls and can approve them on your behalf, so the turn does not stop for a card. This happens only in Auto, and only for these four:
- searching your attached documents in a way that shares the query and matching excerpts with the provider,
- a web search, which shares the query,
- fetching a web page,
- running a command that needs network access.
Everything else that is Sensitive still comes to you in Auto: starting a background agent, publishing a local app, and every tool from an external MCP server are never sent to the reviewer.
Commands have a second gate in front of the reviewer, and it does most of the
work. Before a command is even eligible, it must pass the same static shell
analysis that a broad "allow any command" grant would be held to. That
analysis refuses interpreters, destructive operations, reads and writes of
sensitive paths, and anything reaching outside the folder — which means
script runners and package installers (python script.py, pip install x)
never reach the reviewer at all, whatever their arguments look like. What is
left is a call to a named program with ordinary operands.
The reviewer is only allowed to shorten the path to yes:
- It must answer both safe and confident. Anything else, and the card comes to you.
- If it errs, times out, returns something unparseable, or no model is configured for the role, the card comes to you. There is no cheaper fallback.
- If you answer the card first, your answer wins — the reviewer cannot overturn it.
It runs on the utility model role, the same small model used for other background work, which you can set under Settings → Models. The request carries the action being approved and a short digest of the recent conversation; tool output is not included.
If you would rather every sensitive call stopped for you, use Ask.
Plan mode is a refusal, not a queue
In Plan, a mutating call is refused outright — it does not park on an approval card waiting for you. The agent is expected to read, think, and produce a plan.
When it has one, it presents a plan review card. You can comment on it, ask for an update, or execute it. Executing switches the chat out of Plan for you.
Approval cards
When a call needs your consent, the turn pauses and an approval card appears in the transcript. It is durable: close the app, come back, and it is still waiting.
The options run narrowest to widest:
- Yes, run it once — approves this call and nothing else.
- One or more "always allow" options, which save a standing grant. The available shapes depend on the call: this exact command, any use of this command name, any write under a directory, or the whole tool for the rest of the chat.
- No, don't allow this — refuses, and the agent continues without it.
Everything waiting on you across all chats is collected in the Inbox in the sidebar: approvals, questions, plan reviews, folder access requests, and requests to save into a folder.
Standing grants
An "always allow" answer creates a grant scoped to the chat, or to a project where one applies. Grants are checked before the mode is, so a grant keeps working even in Ask.
Settings → Permissions lists everything you have granted, grouped by chat, with the folder capabilities you have approved. Revoke any of them there and you get asked again next time.
Network access is separate
Permission mode governs whether the agent may act. It does not govern where executed code may connect. That is a separate per-chat setting — see Code execution.