Approval modes
Before the agent touches a file or runs a command, you set the rules of the game. The selector lives in the chat composer itself, under the question “How should actions be approved?”, and you can change it at any time, chat by chat.
The four modes
Section titled “The four modes”| Mode | What it does |
|---|---|
| Read only | Chat only, no writing files and no running commands. The agent can read and search, but changes nothing. |
| Ask for approval | Always ask before editing files and using the internet. Every action with side effects reaches you as an approval card. |
| Approve for me | Asks for approval only for actions detected as potentially unsafe. Reversible things (editing or creating files) go through on their own; the delicate ones are put to you. |
| Full access | Unrestricted access to the internet and to any file on your computer. The agent does not ask. |
How to choose
Section titled “How to choose”- Exploring someone else’s project or auditing code → Read only. A hard guarantee that nothing changes.
- Normal work with supervision → Ask for approval. You see and authorize every edit; ideal while you build up trust.
- Smooth work on your own project → Approve for me. The agent moves forward without interrupting you for every file, but stops at risky actions.
- Long, unattended tasks in a controlled environment → Full access. The selector marks it in a warning color for a reason: use it only when you understand what the agent is about to do.
The approval cards
Section titled “The approval cards”In the modes that ask, every pending action appears in the chat as a card with the details of what the agent wants to do (which file, which command) and buttons to allow or deny it. Approvals can also reach you away from your PC:
- In the mobile app you get a notification and can approve from your phone.
- In web access via QR you decide whether whoever opens the link can approve or only watch (the “Allow approving permissions from the web” option).
Running as administrator
Section titled “Running as administrator”Some tasks simply do not work with normal permissions: installing or starting a service, writing under Program Files, changing a HKEY_LOCAL_MACHINE key, touching the firewall with netsh. On Windows that means elevating the process — what the right-click “Run as administrator” does — and the agent can ask for it.
When it does, two things happen, in this order:
- The app asks you. A card appears with a shield, the heading Run as administrator and the full command, exactly as it will be executed. This question shows up in every approval mode, Full access included, and no “Always allow” covers it: a yes given to a command running with your permissions is not a yes to that same command running with the administrator’s.
- Windows asks you. If you accept, the system shows its own UAC dialog (on macOS, the password dialog; on Linux, polkit’s). The app can never skip it.
Cancel either one and nothing runs — and the agent is told you turned it down.
In the timeline, every command that ran elevated carries an As administrator badge, so you can tell it apart at a glance when reviewing a chat.
How to switch it off
Section titled “How to switch it off”In Settings → Security there is a “Let the agent run as administrator (asks for UAC)” toggle, on by default. With it off, the agent cannot elevate anything: the attempt returns an error and no system dialog opens at all.
Sandbox mode
Section titled “Sandbox mode”On top of approvals, there is an optional sandbox mode that confines the agent to the project folder and blocks sensitive system commands. It is a second wall, independent of the approval mode — more details in Security and privacy.