Permissions and approvals
Where consent gates sit, what YOLO changes, and why the prompt is the cheap moment to say no.
An approval prompt is the last point at which a bad instruction is cheap to stop. Everything else on this page follows from that.
Where instructions come from
An agent's next action can be influenced by any of these, and none of them are trustworthy:
| Source | Why it is untrusted |
|---|---|
| Model output | Can be wrong, or steered |
| Repository content | Written by whoever wrote the repo |
| Web pages in a browser surface | Arbitrary |
| Provider output | Passes through systems you do not control |
| Extension and skill code | Runs with real privileges |
| Messages from peer machines | Originated elsewhere |
SECURITY
Treat all of the above as attacker-controlled input. An approval gate is not bureaucracy; it is the boundary between "something suggested this" and "this happened to my machine."
Modes
Execution mode governs how much an agent may do unprompted:
/mode safe
/mode ask
/mode yolo
| Mode | Behaviour |
|---|---|
safe | Conservative; consequential actions gated |
ask | Prompts before acting |
yolo | Minimal friction |
YOLO defaults to on
WARNING
The desktop's YOLO setting defaults to on, and it injects provider full-access flags at launch. That removes friction, and it removes a safety rail at the same time. Before pointing agents at a repository you care about, look at Settings → Agents / Harmony and decide deliberately.
YOLO is an authority setting. It is separate from Crew Mode, which is about delegation scale. Turning one on does not turn the other on.
A2A mode
Agent-to-agent coordination has its own three-way control:
| Mode | Meaning |
|---|---|
Off | Agents do not message each other |
Connect | Agents may message each other |
Orchestrate | Agents may coordinate work |
Loop prevention watches conversations, but the mode is the real control. If you
do not want agents talking, Off is more reliable than hoping they stay on
topic.
Reading an approval
Three questions:
- What exactly is being asked for? A path, a command, a network call.
- Does it match what I asked the agent to do? Scope creep shows up here first.
- Is it reversible? Reversible actions can be approved faster.
IMPORTANT
Approving quickly, repeatedly, trains you to stop reading. If you find yourself clearing prompts without looking, that is a signal to change mode rather than to keep going.
Permission ceilings for extensions
An extension cannot grant itself more authority than its ceiling permits. This is what keeps a read-only skill from acquiring shell access. It is not a sandbox — see security overview.
Remote messages are contained
Messages arriving from peer machines over LAN Link render as text only. They are never pasted into a PTY and never routed to an execute path. A remote peer cannot make your machine run something by messaging you.