# Permission modes

A permission mode controls how much the AI can do on its own and when it stops
to ask you. It changes the approval boundary, not the quality of the model or
the instructions you gave it.

Choose a mode in the message composer; it applies to that thread. A new thread names its mode
under the composer. In a thread on your default mode, open the model picker and choose
**Permissions** at its bottom, or press `mod+shift+a`. A thread on another mode shows the mode
next to the model.

Set the default for new threads in **Settings → Threads → New threads → Permissions**.
Projects can override the environment default. New threads use this setting rather than the
mode of the thread you were viewing. The initial default is **Full access**; existing threads
and modes you choose in a draft keep their permissions.

## The Modes

**Supervised**: ask before commands and file changes. The agent pauses and shows you what it
wants to run or edit, and waits for approval. Work outside the workspace is restricted.

**Auto-accept edits**: auto-approve edits, ask before other actions. File changes go through
without prompting; commands and anything else still stop for approval.

**Auto**: routine actions proceed without you; risky ones still ask. Providers enforce permissions
differently, and some read-only actions can proceed in **Supervised**. How this is enforced depends
on the provider: Codex delegates routine approvals to an AI reviewer, Claude uses its own auto
permission mode, Cursor uses Smart Auto review, Grok reviews automatically and sends you the
commands its review blocks, and fx handles routine actions itself and sends you anything it still
asks about. Providers without an equivalent (such as OpenCode and Antigravity)
fall back to asking, like Supervised.

**Full access**: allow commands and edits without prompts. The default. The agent runs
unattended until it finishes or asks a question of its own.

Muse Code offers only **Supervised** and **Full access**. A Muse thread already set to another mode
runs in **Supervised**.

An administrator can cap the modes available on a machine with a
[managed policy](./managed-policy.md#permission-modes); modes above the cap show who manages them.

Approvals appear inline in the conversation. Approve or reject one and the agent continues from
there. Subagent approval requests appear in the parent conversation with the subagent's name, so
you can respond without switching threads.

Scient offers no **Auto-accept edits** or **Full access** for fx. An fx thread already set to either
runs in **Supervised**.

Grok offers no **Auto-accept edits**. A Grok thread already set to it runs in **Supervised**. Its
file-change approvals offer **Allow all edits this session**, while its command approvals have no
session-wide choice, because Grok would remember that command for the whole project. Remembering
an approval that way still leaves other actions asking for approval, and it does not change the
thread to **Full access**.

ACP Registry agents run their own tools in their own mode; Scient answers their approval requests
by the permission mode. See [ACP Registry permissions](./providers-acp.md#permissions-and-terminals).

Claude can still ask in **Full access** when its settings disable bypass permissions or require
approval for an action. Dangerous-removal safety checks in bypass mode reject the command with
the original warning. Claude can use a safe rewrite when the warning supplies one; otherwise it
continues without the removal and tells you what it skipped.
While a Claude approval is pending, type a text reply to decline that request and give feedback
directly to the agent that asked, including a subagent. Other pending requests stay unanswered.

Antigravity uses its own permission policy for each mode. Scient still shows any approval or
question the official agent sends in **Full access**. A remembered approval is available only
when the agent offers it for that action. Fixed-choice questions require one of the offered
answers and do not accept custom text.

Overleaf sync adds no permission of its own: an agent links, syncs and settles Overleaf conflicts
under the mode chosen here, like any other tool. See [Overleaf](overleaf.md#agents).

## Choosing a Mode

Use **Full access** for work in an isolated worktree, reproducible analysis
environment, or other project where unattended commands and edits are expected.

Use **Supervised** when working with irreplaceable data, an unfamiliar workflow,
external systems, or any project where an unwanted command or edit would be
expensive.

**Auto-accept edits** suits refactors where the edits are the point and you only care about the
shell commands.

## Provider Behavior

Each provider maps these modes onto its own approval and sandbox controls. Some
providers cannot support every mode exactly and fall back to asking. The labels
above describe the behavior Scient requests; a provider can still ask for an
additional approval when its own safety rules require one.

Codex, for example, translates the mode into its approval policy and sandbox level. Grok threads
similarly use ask mode for **Supervised** and always-approve for **Full access**, regardless of a
different default in the standalone Grok CLI configuration.

Kiro offers only **Supervised** and **Full access**. In **Supervised** Kiro also asks you to
review a turn's file changes. See [Kiro permissions](./providers-kiro.md#permission-modes).

Mobile offers the same four modes with the same labels and descriptions.

Antigravity's native `/plan` command requests a plan. It does not change the permission mode.
Scient's separate Plan mode control is not available for Antigravity. See
[Antigravity](./providers-antigravity.md) for setup and thread limits.