Permission settings

The shield under the chat input is the permission dial. Settings > Permissions holds the sandbox switches and the personal allow/deny list. What Ask, Allowlist, and Bypass mean is on Permissions and approvals.

Change the default dial

The default is Allowlist (agent.permissionLevel). On a live thread, changing the dial writes that personal setting, so later chats start at the same level.

Warning

Bypass skips prompts for file, shell, git, web, and MCP actions. Sensitive paths and denied capabilities still block or ask. Confirm Enable bypass only when you trust the current task.

Auto-approve globs

There is no glob editor in Settings. agent.autoApproveGlobs lives in settings.json (default empty). Personal and project lists are unioned. When every path on a filesystem write or delete matches, that action auto-approves. Matching globs also auto-approve those writes when the dial is Ask.

Sandbox

Settings > Permissions has Sandbox terminal (agent.sandbox.enabled, default on). Sandboxed commands can auto-run. Leaving the sandbox always asks. Sandbox network is Deny or Allow (agent.sandbox.network, default Allow). The network control is disabled when sandbox is off.

OS sandboxing is separate from the permission dial. Unsandboxed or network hops still go through Ask, Allowlist, or Bypass.

Allow and deny records

Settings does not add rows. They appear after you approve or deny in chat with a persist scope.

  • Always writes personal agent.permissions and shows up here.
  • Workspace writes the project's settings.json. Home chats have no project, so workspace persist is refused. A registered project whose folder is your user home directory is personal only, so workspace persist is refused there too. Those project rows do not appear in Settings > Permissions.
  • Once and session do not persist.

Shell persist scopes are once, session, and never only. They never become Settings rows.

The list is grouped as Filesystem, Shell, Git, MCP, and Web. Remove one row, or Clear all to empty the personal list. That is how you take back a persisted allow or deny.

Personal deny wins when personal and project records share a capability. Home chats, and a project rooted at your user home directory, use the personal list only. See the .vixl directory for the merge.

MCP server trust is separate: see MCP servers. A trusted server still passes mcp.call through this dial.