Approval policies
Approval policy decides whether an Agent permission request continues, is denied, or waits for the user. The target CLI enforces the policy. The App creates, synchronizes, selects, and inspects templates.
The App may present an approval request across devices, but the target CLI still evaluates the policy and executes the command. See Devices and security and Data and execution boundaries for device trust, encrypted control channels, and execution boundaries.
Choose an approval mode
Use Ask Every Time for a new device or an unknown project. Use Safe Mode when you want fewer interruptions without broad authorization. Auto Approval, Allow All, and custom rules require an explicit risk review and should not be the first-run default.
| Mode | Behavior |
|---|---|
| Ask Every Time | Every permission request waits for confirmation |
| Safe Mode | Routine workspace actions continue automatically; high-risk actions still ask |
| Auto Approval | An independent AI reviewer handles routine requests; high-risk, incomplete, or uncertain requests still ask |
| Allow All | Every request is allowed automatically, including high-risk operations |
| Custom Rules | Uses the selected template; unmatched or unparseable work asks the user |
Allow All can permit destructive, elevated, network-mutating, and outside-workspace operations. Use it only in an isolated and trusted environment.
Custom rule templates
A template has a name, description, and decision rules. Each rule selects allow, ask, or deny and matches operations using atomic actions, tool patterns, or Condition JSON.
deny overrides allow. Unmatched work, unparseable conditions, and unknown tools ask the user. A template with no rules asks for every operation.
High-risk scopes
Review destructive commands, elevated and system commands, network mutations, outside-workspace access, and unknown tools carefully. Whether normal reads, searches, and workspace edits can continue automatically depends on project sensitivity.
JSON, validation, and observation mode
Advanced JSON supports Approval Policy v1 documents and declarations for Python, JavaScript, SQL, and opaque shell behavior. Resolve validation errors and review warnings before saving.
Observation mode evaluates and records the policy without automatically approving or denying operations. Use it to validate matches before enforcement.
If the App and target CLI use different policy registry versions, update both. A template cannot be applied when the target CLI does not support its protocol version.
For CLI modes, options, and automation behavior, see CLI control and approval modes.
Synchronization and conflicts
Templates can remain on the current App and synchronize to the account after sign-in. A template installed on a device continues working offline.
If both local and account versions changed, Use account version replaces the unsynchronized local edit. Keep this App version creates a new account revision. Deleting a template synchronizes the deletion to other account devices.