permissions section of settings.yaml (was
permissions.yaml) in full: the default_action verdict, the
deny / ask / allow glob lists matched against qualified tool names, and the
dangerous_default_deny list that ships as ["shell:*"] so shell execution is
default-deny the moment a shell tool registers. It will also cover the
human-in-the-loop path (an ask verdict raises an approval interrupt rendered
as a modal in the TUI and a prompt in the REPL, while headless runs auto-deny and
fail closed), plus remember_default_scope, which decides whether an approval is
remembered once, for the thread, or durably per user and agent.
The
permissions section can widen authority, so it is trust-gated: a copy
in an untrusted project layer is ignored wholesale (it falls through to the user
and bundled layers) until you trust the folder.This page is in progress. The shipped
permissions section for each agent is
fully commented and is the best reference until it lands. Legacy split
permissions.yaml files still resolve at each layer as an alternative.permissions section
resolves across config layers, Tools for how tools are named and
namespaced, and Shell and files for the allow-plus-ask
recipe the shipped agents use for run_shell.