Permission Mode
also called Autonomy level
How much the agent may do without asking.
A setting controlling autonomy — from read-only, through approve-each-action, to full autonomy within a sandbox. Usually adjustable per session or per project.
This is the main safety dial in agentic tooling. A reasonable default is auto-approve reads and reversible edits, ask for anything destructive or outside the workspace.
The intended trajectory is to earn autonomy rather than to grant it. Start restrictive, observe what the agent actually does, allow the patterns that proved safe, and keep the dangerous operations ask-gated permanently. The mode is a security posture you tune, not a setting you pick once.
Three modes for three situations
The same repository used for exploration, feature work and unattended jobs.
Read-only for exploration, edits-with-approval for interactive work, and full autonomy only inside a disposable sandbox with a spend cap. Matching the mode to the setting is what makes unattended work defensible.
- docsConfigure permissions ↗
Allow, ask and deny rules for edits, shell commands and other tools: what a permission mode looks like when it is written down.
- docsAgents ↗
Compares a managed hosted agent, an in-app SDK loop, and the raw Responses API, including sessions, handoffs, approvals, sandboxing and compaction.
Permission Request
The agent pausing to ask before doing something risky.
Sandbox
An isolated environment where an agent can act without risk to real systems.
Agent Mode
The mode where the assistant acts instead of suggesting.
AFK · Away from keyboard
Running without a person watching.