Prompt and permission modes
Who may prompt directly, what the agent may do without asking, and how folders outside the session are handled.
Prompt modes
| Mode | What happens to a participant's prompt |
|---|---|
open (default) | It goes straight to the agent, attributed to the participant |
review | It becomes a proposal and waits for the host, who approves, edits or rejects it |
Change it with /mode open|review, from the settings, or at start with --prompts. Tool calls
need the host's approval in both modes. A run that contains a participant's prompt always asks,
whatever the rules say.
Permission modes
The host decides how much the agent may do without asking. shift+tab cycles the modes, and
the line under the composer shows the current one to everyone.
| Mode | What the agent may do |
|---|---|
| ask before changes (default) | Reads freely; every edit and command waits for the host, unless a rule allows it |
| accept edits | Edits files without asking; commands still ask |
| plan mode | Only reads and researches, then replies with a plan. Edits and commands are refused |
| auto mode | Edits and runs commands without asking |
Deny rules hold in every mode, and a run that contains a participant's prompt still asks before
edits and commands, even in auto mode. When a plan is ready the host picks how to start it: a
in auto mode, e accepting edits, y asking before changes, or n to keep planning. A
restarted host always comes back in the default mode.
Folders outside the session
The agent's file tools (read, ls, glob, grep, write, edit, multi_edit) work inside
the folder the session was started in. A path outside it is refused, unless the host opens that
folder first.
- When a run that contains a participant's prompt reaches for a folder outside the session, the
host gets a red card before anything else: who asks, which folder, whether the agent wants to
read or to change files. The host answers read (
r), read + write (w) or refuse (n). Enter on the card refuses, so a stray key opens nothing. - It is asked every time. Nothing is remembered: the answer holds for that one call, and the next call for the same folder asks again. A folder opened for reading cannot be written, whatever the call asks for.
- Only after the host opens the folder does the call itself go through the usual approval, as in the permission modes above.
- The host's own prompts open folders without a question, since they are the host's own disk.
The deny-list still holds everywhere (
.ssh,.aws,.gnupg,.plural,.env, keys): a protected folder is never offered and never opened. - The filesystem root, the home folder or a folder that holds it is marked on the card as broad.
- Shell commands are not covered.
bashis not opened to other folders by this, it asks the host as before, and it is not sandboxed: a command can reach any path the host's user can. Treat a command that is approved as running with the host's full rights.
Approvals and proposals (host)
When something waits for you, an approval card appears above the prompt.
| Key | Action |
|---|---|
y | Allow once |
a | Allow and remember the suggested pattern for the session |
n | Reject |
b | Block this kind of action for the session |
e | Edit a proposal before approving it |
tab | Move between the prompt and what waits for you |
Keys are ignored for a moment after a card appears, and a card never takes the keys of a prompt you are typing.
Writing the rules by hand
/policy shows the current rules; /policy allow|ask|deny <tool> <pattern> adds one and
/policy rm <id> removes it. See the commands reference.