Permissions and approvals

The agent works through tools: it reads and edits files, runs commands, and uses the browser and terminal. A permission mode decides which of those actions wait for your approval. You choose a default for new sessions, and you can change the mode of any session while you work.

AgenC Core, the runtime inside the app, enforces the mode. The app shows you each request and sends your answer back to Core.

Choose a mode

Two places set the mode:

• the permission chip in the composer, beside the + button. In a session it changes that session. On the welcome screen it changes the default for new sessions.
• Settings > General > Sessions > Permission mode, the same default. It does not change sessions that already exist.

When you change the mode of a running session, the app confirms it with a line such as "Permission mode: auto edits." A session that belongs to a routine keeps the routine's mode; the app says "Change permissions in Routines for the next run."

The four modes

Ask for every tool

The default on macOS and Linux. The agent asks before its tools run, and the turn waits for your answer. In a folder you have not trusted, every call asks. In a trusted folder, Core lets the agent read inside the project without asking. Edits, most commands and anything outside the project still ask. The chip reads "ask every tool".

Plan without changes

The agent can read and plan, but not edit. Use it to have the agent study a problem and propose an approach before anything changes. The chip reads "plan". This mode is different from Plan mode in the + menu, which lets the agent decide when a task deserves a plan; see Goal, Swarm and Plan.

Approve edits automatically

File edits inside the project run without asking, and so do simple file commands there, such as mkdir, mv or rm. Other commands still ask. The chip reads "auto edits".

Bypass permissions

The agent runs its tools without asking. Core still refuses a short list of protected actions, such as deleting the project folder, your home folder or .git, and it keeps its command sandbox where your system supports one (macOS and Linux). Choosing this mode for a session also marks its folder as trusted (see below). The chip reads "bypass".

Use it when you trust the task and the folder, or for work that runs while you are away, such as a routine.

On Windows

AgenC Core has no sandbox on Windows yet, and it refuses to start a session in the other three modes there. So on Windows the permission chip, Settings > General and the new session dialog offer only "Bypass permissions (the only mode on Windows until Core ships a sandbox)", and it is the default. The app also does not give agents its own tools on Windows, such as control of its browser and terminal; see Browser and terminal.

Answer an approval request

When a tool needs approval, a sheet rises from the composer with the title "Permission required". It shows the tool's name, a one-line summary of what it wants to do, and the reason Core gives. Details opens the full request.

For a request that writes a file, the sheet always says what will happen to the existing file: "Creates a new file; nothing is overwritten.", or "Overwrites an existing file" with its line count and the current content. If the app could not check the file, it warns that approving may overwrite it.

Your choices:

• Allow once: this request only. Shortcut 1.
• Allow for session: allow this tool for the rest of this session. Shortcut 2.
• Deny: refuse the request. Shortcut 3. Core tells the agent the request was denied.

The number keys answer the sheet only; a digit typed in the composer stays text. While the window is in the background, the app can send a desktop notification, "Approval needed", with the tool's name; see Settings reference.

Requests from sub-agents appear in the same way, with the sub-agent named in the title, and also in the agents panel. See Sub-agents.

Answer the agent's questions

Sometimes the agent asks you something instead of acting, for example which of two approaches to take. The sheet shows the question and its options. Click an option, or type your own answer in "or type your own answer" and press Enter. When a question allows several options, pick them and click Confirm. Skip declines to answer. A request can hold several questions; they come one after the other.

Requests from MCP servers

A plugin or an MCP server can also ask you for something. An "MCP server form" asks for values to fill in. An "MCP server link" asks you to open a link, and shows its host, its origin and the full address. Answer accepts the request with what you entered, and Dismiss declines it.

Approve a plan

When the agent finishes a plan in plan mode, the sheet asks "Implement this plan?" and shows the plan.

• Yes, implement this plan leaves plan mode and starts the work.
• No, keep planning stays in plan mode so the agent can revise.

A plan that is too long to show in full, or a request that carries two different versions of the plan, cannot be approved there. Keep planning to get one shorter plan.

Trusted folders

Core keeps a list of trusted projects. In a folder it does not trust, it asks before every tool call, whatever the mode.

The app records trust when you choose Bypass permissions for a session or a routine in that folder. Trust belongs to the whole project: trusting a folder inside a Git repository trusts the repository, with its project configuration, hooks and MCP servers. The first time that happens the app says "This folder is part of the project at ~/your-repo. Trusting it trusts that project."

From a phone or another browser

When you use a session from another device, approval requests show only Allow once and Deny. Questions and plan approvals say "Approval needed. Answer this request on your computer." See Phone and remote access.