Permission modes control when an agent needs your approval to act. Choose a mode in the message
composer; it applies to that thread. A new thread names its mode under the composer. In a thread
on your default mode, open the model picker and choose Permissions at its bottom, or press
mod+shift+a. A thread on another mode shows the mode next to the model.
Set the fallback for new threads in Settings → Threads → New threads → Permissions. Projects can override the environment fallback. Each provider instance can override the fallback in Settings → Providers → Runtime. A new draft follows the selected provider instance until you explicitly pick a mode in the composer; that choice remains fixed when you switch providers. New threads never inherit the mode of another thread, and existing threads keep their permissions.
| Mode | Behavior |
|---|---|
| Supervised | Requests approval for commands and file changes. |
| Auto-accept edits | Approves file edits automatically; other actions can still require approval. |
| Auto | Uses the provider's automatic review to approve routine actions and ask about others. |
| Full access | Allows commands and edits without approval prompts. |
An administrator can cap the modes available on a machine with a managed policy; modes above the cap show who manages them.
Approve or reject requests in the conversation to let the agent continue. Permission modes do not prevent the agent from asking questions about the task. Subagent approval requests appear in the parent conversation with the subagent's name, so you can respond without switching threads.
Providers enforce permissions differently. Some read-only actions can proceed in Supervised. Auto uses automatic review on Codex, Claude, Cursor, Grok, and fx; providers without an equivalent, including OpenCode and Antigravity, fall back to asking. On Grok, commands its review blocks come to you for approval. On fx, prompts it still sends also come to you.
Muse Code offers only Supervised and Full access. A Muse thread already set to another mode runs in Supervised.
T3 Code offers no Auto-accept edits or Full access for fx. An fx thread already set to either runs in Supervised.
Grok offers no Auto-accept edits. A Grok thread already set to it runs in Supervised. Grok file-change approvals offer Allow all edits this session. Its command approvals have no session-wide choice, because Grok would remember that command for the whole project.
ACP Registry agents run their own tools in their own mode; T3 Code answers their approval requests by the permission mode. See ACP Registry permissions.
Claude can still ask in Full access when its settings disable bypass permissions or require approval for an action. Dangerous-removal safety checks in bypass mode reject the command with the original warning. Claude can use a safe rewrite when the warning supplies one; otherwise it continues without the removal and tells you what it skipped. While a Claude approval is pending, type a text reply to decline that request and give feedback directly to the agent that asked, including a subagent. Other pending requests stay unanswered.
Antigravity can still send native approval requests in Full access. It only offers remembered approvals for actions that support them.
Kiro offers only Supervised and Full access. In Supervised Kiro also asks you to review a turn's file changes. See Kiro permissions.
See the provider guides for setup and provider-specific limits.