Skip to main content
Plan approvals gate the changes the agent proposes to your infrastructure. Auto-authorization (Auto Mode) works one level down — on the individual shell commands the agent runs while it investigates and executes, both in its sandbox and as local commands. Without it, either every command runs unattended, or you approve each one by hand. Auto-authorization gives you the middle: safe commands run on their own, risky ones pause for you, and you decide where that line sits.

​
How a command is judged

When enabled, every command the agent runs passes through a layered check, in order:
  1. Catastrophic floor — irreversible operations (deleting a namespace, wiping a disk, force-pushing) always require your approval. Nothing can auto-allow them — not a rule, not the judge, not a prior “always”. This floor is fixed.
  2. Read-only fast-path — commands that only read (kubectl get, ls, cat, a plain curl GET) run immediately.
  3. Your standing rules — an LLM judge checks the command against the rules you’ve set (see below). A match runs it.
  4. Ask you — anything else pauses for a human decision.
If the judge is ever unavailable, Auto-authorization fails safe: the command pauses for approval rather than running unchecked.

​
Approving a command

When a command needs your yes, the turn pauses at that step — the agent stops and the command card shows four choices:

Approve once

Run this one command, this once.

Approve for session

Auto-allow this exact command for the rest of this conversation.

Always allow

Create a standing rule so this class of command auto-runs from now on, in every conversation.

Deny

Don’t run it — the agent stands down and suggests another approach.
Approving resumes the turn and the agent re-runs the command; denying leaves it stopped. Irreversible commands can be approved once or for the session, but never set to always — the catastrophic floor holds.

​
Standing rules

Rules are how you move the line permanently. A rule is a plain-language description of a class of operations you trust the agent to run without asking — for example “restart deployments in the staging namespace”. They are per-user and apply across all your conversations. You can create rules two ways:
  • In Settings → Auto-authorization — add, review, and delete your rules in one list.
  • From chat — tell the agent “from now on you don’t need to ask before restarting staging deployments” and it will propose a matching rule. A proposed rule does nothing until you confirm it in Settings — the agent can never weaken its own authorization. Rules covering deletes, production, or other irreversible operations are refused.

​
Seeing why a command ran

Every auto-authorized command is annotated with why it was allowed — read-only, a rule you set (named), or a command you approved earlier in the session. Expand the command card to see it, so there’s never any doubt about what ran on its own and under whose authority. These decisions are also written to the audit trail.
Start strict: leave Auto-authorization off (or with no rules) so everything pauses, then add a rule the first time the agent asks about a command you’re happy to let it run unattended. Approving with Always allow writes that rule for you.