Approvals and permissions
Decide which tools the agent may use on its own, which ones must ask you first, and which are off limits, for good or for a single chat.
The agent can read files, run commands, browse the web, and use your integrations. You decide how much of that happens without asking. Set the defaults once, then loosen or tighten them per chat when the task calls for it.
Allow, Ask, or Block
Open Settings → Tools. Each toolkit has a switch to turn it on or off, and a toolkit that is off also disappears from the composer's tools menu. Open a toolkit to set its Default approval:
- Allow: the tool runs automatically. Pick this for tools you trust, such as reading files or searching the web.
- Ask: the agent pauses and shows you what it wants to do. You approve or deny each time.
- Block: the tool is hidden from the agent entirely. It cannot ask for it.
Below the default you can override individual tools, so a toolkit can be mostly Allow with one or two tools set to Ask. Integrations work the same way: choose Manage permissions from the composer's tools menu to set Allow, Ask, or Block for each action an integration can take. See Integrations.
When the agent asks
An Ask tool pauses the run and shows an approval card in the chat describing the action. Click Approve to let it run once, or press Cmd+Enter. Click Deny to stop it. Open More options and choose Allow this tool for this chat to stop being asked about that tool for the rest of the conversation. The agent waits until you answer.
Permissions for one chat
The permissions selector in the composer overrides your settings for the chat you are in:
- Standard: use your configured per-tool permissions.
- Always Ask: ask for approval before every tool action. Good for a sensitive repository or an unfamiliar model.
- Allow Everything: run every tool without asking. Blocked tools stay blocked. Good for a long, well-defined task you want to leave running.
The choice stays in place until you reset it to Standard.
Code isolation
Under Settings → Tools, turn on Sandbox code & terminal execution to confine the agent's commands and scripts to your project and block reads of credential folders. Turn off Allow network access to stop sandboxed code from reaching the internet. The sandbox is off by default and is worth turning on with smaller or less trusted models.