Permission modes

A folder's permission mode decides whether the agent's writes and commands on your computer ask first. Reads never ask.

Mode	Writes in the folder	Commands	Notes
Ask	ask	ask	A new folder's mode
Accept edits	run	ask
Workspace free	run	run, inside the sandbox	Only available while the sandbox works on your computer; git push keeps its card
Fully free	run	run, without the sandbox	This chat only, never saved; you confirm it, and it shows a red mark while it is on

Change it from the app, with /mode ask, /mode edits or /mode workspace, or for one CLI run with --mode. Fully free is /mode free in the terminal (after you confirm) or --dangerously-skip-permissions; a new chat ends it. Each switch is recorded.

Your organization's policy can cap the highest mode; modes above it are greyed out with a note saying why.

What asks in every mode

Even in Fully free, these always wait for your yes:

• destructive writes: an app action that deletes or overwrites, a write to many recipients, a production deploy, removing a schedule;
• any write in a turn that read outside data (an e-mail, a web page, app records); see Untrusted data;
• a git push to a new address, and switching the chat to another folder.

Rules

When a card asks, it offers three answers: yes, once; always in this folder; and no. "Always" saves a rule with the folder, such as:

cmd.run: git status*
fs.write: src/**
secrets: .env

A command rule's * never matches shell operators (;, &&, |…), so a rule can't allow a chained command. In the terminal, /permissions lists the rules, and /permissions add RULE and /permissions rm N change them.

Print mode

crewdesk -p can't ask, so whatever would ask is refused, with one line saying how to allow it: --mode, --allow-commands, a rule, or --dangerously-skip-permissions.