Modes and permissions
Safe, ask, and yolo — what each one lets an agent do without asking you first.
Mode is the authority setting for a session: how much an agent may do before it has to stop and ask.
/mode safe
/mode ask
/mode yolo
/permissions
The three modes
| Mode | Consequential actions | Use when |
|---|---|---|
safe | Gated | You are working in a repository you care about |
ask | Prompts before acting | Default working posture for most people |
yolo | Minimal friction | Throwaway sandboxes, or work you will discard |
WARNING
yolo is not "faster mode". It is "fewer chances to stop it" mode. The speed
you gain is the speed of not being asked, which is the same thing as not
getting to say no.
Mode is per session
Changing mode affects the current session. Two sessions in the same workspace can run at different authority levels, which is useful: a read-only exploration session and a gated implementation session can coexist.
Check what you are actually in before assuming:
/permissions
What an approval prompt is for
The prompt is the last cheap moment to stop something. Everything reaching an agent is untrusted input — model output, repository contents, browser pages, provider responses, messages from peers.
SECURITY
A repository can contain text written specifically to steer an agent. Reading a file is not neutral. This is the reason gates exist at the action boundary rather than the input boundary.
Reading a prompt properly
- What is the exact action? A path, a command, a network destination.
- Does it match what I asked for? Scope creep appears here first.
- Is it reversible?
If you find yourself clearing prompts without reading, that is a signal to change mode, not to keep approving.
Desktop YOLO defaults on
The desktop's YOLO setting defaults to on and injects provider full-access flags at launch. It is separate from the per-session mode here, and separate again from Crew Mode, which is about delegation scale rather than authority.
Three different switches. Turning one on does not turn the others on. See security permissions.
Extension permission ceilings
An extension cannot exceed its permission ceiling, which is how a read-only skill does not quietly acquire shell access.
IMPORTANT
A ceiling is not a sandbox. Extension code is not sandboxed by default — it runs with the privileges of the process that loaded it.