> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuphos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Auto-authorization

> Let the agent run safe commands on its own, pause on the rest for a human yes — with standing rules you control.

[Plan approvals](/security/approvals) gate the *changes* the agent proposes to
your infrastructure. **Auto-authorization** (Auto Mode) works one level down — on
the individual shell commands the agent runs while it investigates and executes,
both in its [sandbox](/agent/sessions) and as [local commands](/agent/local-commands).

Without it, either every command runs unattended, or you approve each one by hand.
Auto-authorization gives you the middle: safe commands run on their own, risky ones
pause for you, and *you* decide where that line sits.

## How a command is judged

When enabled, every command the agent runs passes through a layered check, in order:

1. **Catastrophic floor** — irreversible operations (deleting a namespace, wiping a
   disk, force-pushing) **always** require your approval. Nothing can auto-allow
   them — not a rule, not the judge, not a prior "always". This floor is fixed.
2. **Read-only fast-path** — commands that only read (`kubectl get`, `ls`, `cat`,
   a plain `curl` GET) run immediately.
3. **Your standing rules** — an LLM judge checks the command against the rules
   you've set (see below). A match runs it.
4. **Ask you** — anything else pauses for a human decision.

If the judge is ever unavailable, Auto-authorization **fails safe**: the command
pauses for approval rather than running unchecked.

## Approving a command

When a command needs your yes, the turn **pauses** at that step — the agent stops
and the command card shows four choices:

<CardGroup cols={2}>
  <Card title="Approve once" icon="check">
    Run this one command, this once.
  </Card>

  <Card title="Approve for session" icon="clock">
    Auto-allow this exact command for the rest of this conversation.
  </Card>

  <Card title="Always allow" icon="infinity">
    Create a standing rule so this class of command auto-runs from now on, in
    every conversation.
  </Card>

  <Card title="Deny" icon="xmark">
    Don't run it — the agent stands down and suggests another approach.
  </Card>
</CardGroup>

Approving resumes the turn and the agent re-runs the command; denying leaves it
stopped. Irreversible commands can be approved **once** or **for the session**, but
never set to **always** — the catastrophic floor holds.

## Standing rules

Rules are how you move the line permanently. A rule is a plain-language description
of a class of operations you trust the agent to run without asking — for example
*"restart deployments in the staging namespace"*. They are **per-user** and apply
across all your conversations.

You can create rules two ways:

* **In Settings → Auto-authorization** — add, review, and delete your rules in one
  list.
* **From chat** — tell the agent *"from now on you don't need to ask before
  restarting staging deployments"* and it will **propose** a matching rule. A
  proposed rule does **nothing** until you confirm it in Settings — the agent can
  never weaken its own authorization. Rules covering deletes, production, or other
  irreversible operations are refused.

## Seeing why a command ran

Every auto-authorized command is annotated with *why* it was allowed — read-only,
a rule you set (named), or a command you approved earlier in the session. Expand
the command card to see it, so there's never any doubt about what ran on its own
and under whose authority. These decisions are also written to the
[audit trail](/security/approvals#audit-trail).

<Tip>
  Start strict: leave Auto-authorization off (or with no rules) so everything
  pauses, then add a rule the first time the agent asks about a command you're
  happy to let it run unattended. Approving with **Always allow** writes that rule
  for you.
</Tip>