permission mode

advancedspreading

A setting that defines what an AI agent can do independently and what requires your prior permission.

In plain terms

Imagine you get a new colleague. In the first week, they show you everything before sending it off; later they ask only about important matters; in the end, you dare to hand routine work over to them. The permission mode is the same degree of trust, but for an AI agent, set with a single switch.

The agent not only writes text but also acts: it modifies files, runs commands, sends emails, and opens websites. The permission mode determines which of these can proceed automatically, which pause to ask for approval, and which are forbidden.

Typical levels include: read-only and planning; read freely but ask before every modification or command; perform edits automatically but pause at riskier steps; and finally, fully autonomous mode, where it asks nothing. Some tools also have an intermediate, automatic mode where a built-in security check decides what can proceed without questions. The freer the mode, the faster the work, but the less control you have.

How it works

Before each step, the agent signals the framework what it intends to do, such as rewriting a file or executing a command.
The framework checks the current permission mode and its associated rules: what is allowed, what is forbidden, and what requires approval.
If the step falls within the permitted scope, it executes immediately; if not, it stops and shows you what it plans to do.
You approve, reject, or tell it not to ask about such a step again in future.
You can switch modes while working: stricter for planning, looser for routine tasks.

An everyday example

You ask the coding agent to organize your project folders. In basic mode, it asks before every rename. In edit-accepting mode, it performs file operations within the project folder itself and typically only speaks up if it wants to run another command or program. If you set it to 'plan only' mode, it touches no files, only describing what it would do.

Who is affected

developerEvery day, this is what you use to decide how much freedom to give the coding agent on your own machine and in the company's code. → Code

entrepreneur, executiveIt must define in what mode agents can work with corporate data and systems.

employeeIf an agent works on your emails or documents, this determines what can happen without your knowledge. → Work & HR

A common misconception

MythIf I set strict mode, the agent cannot cause harm.

In realityThe mode mainly determines when the agent must stop and ask. If you blindly agree to a bad step, it will happen just the same. The strict mode therefore reduces risk but does not replace your attention.

Limits and risks

Asking too many questions is tiring, and over time you may become prone to approving everything without thinking.
In fully autonomous mode, a misunderstood request or a malicious, hidden instruction can cause irreversible damage, such as deleting data.
The names and precise meanings of the modes vary from tool to tool, so with a new program always check what the default setting allows.
The permission mode does not replace backups and an isolated, protected runtime environment.

Similar, but not the same

sandbox – A sandbox is a technical wall: the agent cannot touch anything outside the designated area even if it tries. Permission mode, by contrast, only regulates when it must ask for approval. Together, they offer the best protection.
user permission – It determines what a person can access in a system; the permission mode determines what an agent can do on your behalf without asking.
guardrail – The guardrail is typically built in by the developer and filters content or behavior; the permission mode is set by you and defines the scope of action.

Related concepts

Broader

AI-agent, AI safety, human oversight

Narrower

plan mode, automatic mode, allowlist

On the edge

sandbox, guardrail, tool use, prompt injection, principle of least privilege

A brief history

The core idea, the principle of least privilege, is an old rule of information security. The term itself spread with coding agents in 2025, when command-line AI tools like Claude Code and Codex CLI received selectable levels of autonomy.

Where things stand

As of late 2026, it is already a basic feature in coding agents, and it has also appeared in office and browser-based agents. There is no unified name or standard, though; every manufacturer uses its own levels.

Status: 2026 November

In the news

Appears in 6 Agent Age stories; the curve shows weekly occurrence in the news magazine.

Claude Code now reads AGENTS.md, and auto mode safety checks are freeSep 21, 2026 · Code
GitHub Copilot auto model selection gains cost and quality modesSep 14, 2026 · Code
Claude Code vulnerabilities: CI/CD leak, auto mode bypassed, AWS credential theftSep 7, 2026 · Code
Claude Code Auto Mode: malware passes through agent's approval stepAug 28, 2026 · Code
Claude Code's auto mode to become the default, with fewer human approvalsAug 10, 2026 · Code
Auto Mode to become the default in Claude CodeAug 3, 2026 · Code

Also known as

permission mode · permission mode · approval mode · approval mode · permission level · Autonomy level · auto mode · YOLO mode

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.