Permission modes

A permission mode controls how much the AI can do on its own and when it stops to ask you. It changes the approval boundary, not the quality of the model or the instructions you gave it.

Choose a mode in the message composer; it applies to that thread. A new thread names its mode under the composer. In a thread on your default mode, open the model picker and choose Permissions at its bottom, or press mod+shift+a. A thread on another mode shows the mode next to the model.

Set the default for new threads in Settings → Threads → New threads → Permissions. Projects can override the environment default. New threads use this setting rather than the mode of the thread you were viewing. The initial default is Full access; existing threads and modes you choose in a draft keep their permissions.

The Modes

Supervised: ask before commands and file changes. The agent pauses and shows you what it wants to run or edit, and waits for approval. Work outside the workspace is restricted.

Auto-accept edits: auto-approve edits, ask before other actions. File changes go through without prompting; commands and anything else still stop for approval.

Auto: routine actions proceed without you; risky ones still ask. Providers enforce permissions differently, and some read-only actions can proceed in Supervised. How this is enforced depends on the provider: Codex delegates routine approvals to an AI reviewer, Claude uses its own auto permission mode, Cursor uses Smart Auto review, Grok reviews automatically and sends you the commands its review blocks, and fx handles routine actions itself and sends you anything it still asks about. Providers without an equivalent (such as OpenCode and Antigravity) fall back to asking, like Supervised.

Full access: allow commands and edits without prompts. The default. The agent runs unattended until it finishes or asks a question of its own.

Muse Code offers only Supervised and Full access. A Muse thread already set to another mode runs in Supervised.

An administrator can cap the modes available on a machine with a managed policy; modes above the cap show who manages them.

Approvals appear inline in the conversation. Approve or reject one and the agent continues from there. Subagent approval requests appear in the parent conversation with the subagent’s name, so you can respond without switching threads.

Scient offers no Auto-accept edits or Full access for fx. An fx thread already set to either runs in Supervised.

Grok offers no Auto-accept edits. A Grok thread already set to it runs in Supervised. Its file-change approvals offer Allow all edits this session, while its command approvals have no session-wide choice, because Grok would remember that command for the whole project. Remembering an approval that way still leaves other actions asking for approval, and it does not change the thread to Full access.

ACP Registry agents run their own tools in their own mode; Scient answers their approval requests by the permission mode. See ACP Registry permissions.

Claude can still ask in Full access when its settings disable bypass permissions or require approval for an action. Dangerous-removal safety checks in bypass mode reject the command with the original warning. Claude can use a safe rewrite when the warning supplies one; otherwise it continues without the removal and tells you what it skipped. While a Claude approval is pending, type a text reply to decline that request and give feedback directly to the agent that asked, including a subagent. Other pending requests stay unanswered.

Antigravity uses its own permission policy for each mode. Scient still shows any approval or question the official agent sends in Full access. A remembered approval is available only when the agent offers it for that action. Fixed-choice questions require one of the offered answers and do not accept custom text.

Overleaf sync adds no permission of its own: an agent links, syncs and settles Overleaf conflicts under the mode chosen here, like any other tool. See Overleaf.

Choosing a Mode

Use Full access for work in an isolated worktree, reproducible analysis environment, or other project where unattended commands and edits are expected.

Use Supervised when working with irreplaceable data, an unfamiliar workflow, external systems, or any project where an unwanted command or edit would be expensive.

Auto-accept edits suits refactors where the edits are the point and you only care about the shell commands.

Provider Behavior

Each provider maps these modes onto its own approval and sandbox controls. Some providers cannot support every mode exactly and fall back to asking. The labels above describe the behavior Scient requests; a provider can still ask for an additional approval when its own safety rules require one.

Codex, for example, translates the mode into its approval policy and sandbox level. Grok threads similarly use ask mode for Supervised and always-approve for Full access, regardless of a different default in the standalone Grok CLI configuration.

Kiro offers only Supervised and Full access. In Supervised Kiro also asks you to review a turn’s file changes. See Kiro permissions.

Mobile offers the same four modes with the same labels and descriptions.

Antigravity’s native /plan command requests a plan. It does not change the permission mode. Scient’s separate Plan mode control is not available for Antigravity. See Antigravity for setup and thread limits.