Agent permissions

Each supported agent has its own set of permission modes, set per-workspace in Settings → Agents. This page goes into what each mode actually does; for how the approval prompts themselves are surfaced, see The approval system.

Claude Code

Claude Code's modes are enforced through the Claude Agent SDK's canUseTool callback:

• default — prompts for tool calls that need approval, following Claude Code's own built-in rules.
• acceptEdits — file edits are accepted automatically; other tool calls still prompt.
• plan — Claude can read and reason about your codebase but is restricted from making changes, useful for review-only sessions. This is what Compare Mode forces Claude Code panes into.
• bypassPermissions — skips prompts entirely. Use deliberately; see Recommended practices.
• dontAsk / auto — additional non-interactive modes exposed by the SDK.

Codex

Codex's modes are sandbox tiers set once when a thread is created — there's no live switch mid-conversation:

• default — Codex's standard sandbox behavior.
• read-only — Codex can inspect the workspace but cannot write to it. This is what Compare Mode forces Codex panes into.
• workspace-write — write access scoped to the current workspace.
• danger-full-access — no sandbox restriction.
• bypass — skips the sandbox and approval prompts.

Antigravity

Antigravity is PTY-based, so its modes are passed as --mode launch flags and its prompts are detected by classifying terminal output:

• default — standard interactive behavior.
• accept-edits (--mode accept-edits) — edits proceed without individual prompts.
• plan (--mode plan) — restricted to planning/read behavior; used for Antigravity's Compare Mode panes.
• bypass (--dangerously-skip-permissions) — skips prompts entirely.