permissions.yaml in full: the default_action verdict, the
deny / ask / allow glob lists matched against qualified tool names, and the
dangerous_default_deny list that ships as ["shell:*"] so shell execution is
default-deny the moment a shell tool registers. It will also cover the
human-in-the-loop path (an ask verdict raises an approval interrupt rendered
as a modal in the TUI and a prompt in the REPL, while headless runs auto-deny and
fail closed), plus remember_default_scope, which decides whether an approval is
remembered once, for the thread, or durably per user and agent.
This page is in progress. The shipped
permissions.yaml for each agent is
fully commented and is the best reference until it lands.permissions.yaml resolves
across config layers, Tools for how tools are named and
namespaced, and Shell and files for the allow-plus-ask
recipe the shipped agents use for run_shell.