Permission mode

Permission mode is the rule the harness applies to every tool call before running it: execute silently, or stop and raise a permission request. It ranges from cautious (ask about every edit and every command) through allowlists (routine commands run, unusual ones ask) to fully automatic (nothing asks). The model doesn't change; what changes is how much can happen between your glances at the screen.

The mode shapes the work more than people expect. In a strict mode the agent moves in short hops and you stay in the loop by default. In a permissive mode it can complete a whole feature while you get coffee, and it can also delete a directory, push to the wrong branch, or run a script that phones home. 'YOLO mode' is the community name for the fully automatic end for a reason. The danger isn't the mode itself, it is running it outside a sandbox on a machine that holds things you care about.

Match the mode to the blast radius. Interactive work on a real checkout: allowlist the safe commands and keep asking for the rest. Unattended or parallel runs: go permissive, but inside a container, a worktree or a cloud session with no production credentials, and end in a PR rather than a merge. And read the diff afterwards regardless; permissions gate actions, they don't check quality.