> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ziro-agent.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tool permissions

> Gate every tool call behind a per-agent policy of allow, deny, and ask globs, with human approval and remembered grants.

Every tool call passes through a per-agent permission gate before it runs. This
page will cover `permissions.yaml` in full: the `default_action` verdict, the
`deny` / `ask` / `allow` glob lists matched against qualified tool names, and the
`dangerous_default_deny` list that ships as `["shell:*"]` so shell execution is
default-deny the moment a shell tool registers. It will also cover the
human-in-the-loop path (an `ask` verdict raises an approval interrupt rendered
as a modal in the TUI and a prompt in the REPL, while headless runs auto-deny and
fail closed), plus `remember_default_scope`, which decides whether an approval is
remembered once, for the thread, or durably per user and agent.

<Note>
  This page is in progress. The shipped `permissions.yaml` for each agent is
  fully commented and is the best reference until it lands.
</Note>

See [Configuration](/guides/configuration) for how `permissions.yaml` resolves
across config layers, [Tools](/concepts/tools) for how tools are named and
namespaced, and [Shell and files](/guides/shell-and-files) for the allow-plus-ask
recipe the shipped agents use for `run_shell`.