Docs · permissions
Tool permissions
Use permission modes to decide which actions need approval. Tool switches are tested first: a disabled tool stays unavailable in every mode.
The five modes
Set in the panel, or with /perm in the console. Per conversation; auto is the default.
| Mode | Reads | Edits | Acts |
|---|---|---|---|
| bypass | run | run | run |
| auto (default) | run | ask | ask |
| edits | run | run | ask |
| manual | ask | ask | ask |
| plan | run | refused | refused |
A few actions are allowed in every mode, including plan: recalling memory, searching history, asking you a clarifying question, reading a project's notes, listing your own machines, and drawing a checklist.
The switch beats the mode
Modes control approvals; switches disable tools. For example, you can allow file edits while disabling shell commands. A disabled tool is refused in every mode, including bypass, until you enable it again.
When it asks
An ask is a real question in the conversation, mid-turn: the tool, its kind (read / edit / act) and its arguments are shown, and nothing runs until you answer. Decline, and the model is told plainly and works around it — it does not retry the same call.
Asking you a question
The clarify tool is how the assistant asks you something mid-task. Unlike a reply that ends with buttons, clarify pauses the turn where it is and your answer comes back as a tool result — so the model continues from exactly where it paused, still holding everything it had worked out. This lets the assistant continue after you answer.