Permissions, Approvals, and Tool Safety
Decide which tools run automatically and which need a human. Permission modes, allowlists, and designing safe destructive actions.
There are two ways to get permissions wrong with agents, and most people try both. The first is approving everything by hand: you click "yes" two hundred times a day, and within a week you're approving without reading. The second is the overcorrection: you turn on "skip all permissions," and one day the agent force-pushes over your teammate's work or emails a draft to a customer.
Neither extreme is safe, because a human who rubber-stamps everything isn't really a safeguard. The goal is to spend human attention only where it matters. This lesson gives you a framework for deciding which tool calls run automatically, which need approval, and which should never happen. You'll learn to use permission modes, allowlists, and hooks in practice, and to design destructive actions in your own tools so that mistakes are hard to make and easy to undo.
Why permissions matter more for agents
A chatbot that gives bad advice produces bad text. An agent that makes a bad decision produces a bad action: a deleted file, a sent email, a charged card. And agents can make bad decisions for reasons that have nothing to do with intelligence:
- Misunderstanding. "Clean up the old branches" can mean very different things.
- Overreach. Asked to fix a failing test, an agent might "fix" it by deleting the test.
- Manipulation. Text the agent reads (a web page, an email, a GitHub issue, an MCP tool result) can contain instructions designed to hijack it. That's prompt injection, covered in depth in Prompt Injection and How to Defend Against It.
Prompt instructions can't fully prevent any of these. Permissions are the layer that still holds when the model gets it wrong.