bar chart
Share of actions allowed without a prompt, by mode
Rough share of the kinds of action in the mode table, rounded. Network is denied in every mode except bypass.
Same allows as autonomous; the leftover asks become denies
bar chart
Share of actions that stop to ask a human, by mode
Table cells only, rounded. Writes to the artifact store still ask in every mode except bypass, never-prompt included.
No ask cells, but artifact-store writes still ask
Running any command used to need my click in the coding agent. That works when I'm watching. It doesn't work for a job I want to leave running.
So I added modes. Planning only reads. The default asks before it changes things. Accept-edits stops asking about file edits. Autonomous also runs commands. Never-prompt says no to anything the table would have asked about. Bypass allows it all. One table holds the answer for each mode and each kind of action: allow, ask or deny. The hard part was making sure no mode can touch my real checkout or a secrets file.
One place to ask
Each tool used to make its own call, with its own rules. Now they all ask one function. If you build something like this, do the same. A new mode is then one change, not one per tool. Have it return the reason and the mode with the answer, so a no explains itself.
Pick the mode from the project first, then the user, then any old setting. If the name is unknown, fall back to the careful default. Keep bypass off unless someone turns it on on purpose.
Where the secret and checkout vetoes sit
Before looking at the table, decide what kind of place the request points at.
Secrets are refused outright, the checkout is refused unless bypass is on, the table gives the answer, and an approval can lift an ask to a yes.
Secrets are a no in every mode. The checkout is a no unless bypass is on, so the agent works in a copy. An approval turns an ask into a yes but never turns a no into a yes. A missing entry is a no. Anything allowed that points at the artifact store, writes included, still asks in every mode but bypass, so even never-prompt can stop and wait there.
Older code that still read the old setting
My writer still read the old setting, so a yes from the new check could still get blocked. My input check also wanted an approval even when the answer was already yes. Find those spots and fix them, then test with real files: a write that should land, and the same write in the checkout that shouldn't.
Not done yet
A request can name its own kind of place and skip the secret rule. Any approval ID passes this check. And the project file can turn bypass on, so whoever writes it picks the mode.