Permission modes

Set via permissions.mode in settings.json or POLYGLOT_PERMISSION_MODE.

Mode	Behavior
manual (default)	Every write / execute / network tool call prompts for approval. Reads within the working directory don’t prompt.
auto	Tool calls run without prompting, unless they match a deny rule.
plan	Only read-only and network research tools (read_file, grep, glob, web_fetch, web_search) run automatically. write_file, edit_file, bash, and task are hard-denied until the model calls exit_plan_mode with a plan and you approve it - then the session drops into manual for the rest of the conversation. See Plan mode.

Allow / deny rules

Strings in permissions.allow and permissions.deny:

• "read_file" - matches every call to that tool, regardless of arguments.
• "bash:git *" - matches only when the tool’s primary argument matches the glob: command for bash, path for the file tools, url for web_fetch, query for web_search.

deny is checked first and always wins. allow rules are also an escape hatch for the always-prompt cases below.

Always-prompt paths

Two kinds of target prompt in every mode (and are denied outright in -p mode without --allow-all):

• Outside the working directory - any file path that resolves above cwd.
• Credentials / key files - .env / .env.*, *.pem / *.key / *.p12, id_rsa and friends, .npmrc, .netrc, anything under .ssh/ / .aws/ / secrets/, and similar.

glob and grep also skip those files, so an ordinary search never pulls a secret into context - read_file can still fetch one explicitly, which prompts. An allow rule (e.g. "read_file:**/.env") overrides the prompt. bash is not covered (no path argument), so bash: cat .env follows the plain mode rules.

The approval prompt

Both the tool-approval and plan-approval prompts are an ↑↓ list (Enter to select) with letter shortcuts (y allow once / a allow this tool for the session / n deny) alongside, plus Comment (c): instead of a plain yes/no, type free text saying what you’d rather it do - it stops the current action and sends what you typed as your next message. Esc denies (or backs out of a comment).