What each coding agent can enforce.

permissions.allow with Bash(...) rules, or --allowedTools for one session. Granularity: exact match (no *), prefix (cmd * or legacy cmd:*), and glob-style * anywhere (matches any text including spaces). No regex. Example: {"permissions": {"allow": ["Bash(npm run test *)", "Bash(git diff *)"]}}

Execpolicy .rules files (Starlark) in a rules/ folder next to an active config layer, e.g. ~/.codex/rules/default.rules: prefix_rule(pattern = ["gh", "pr", ["view", "list"]], decision = "allow"). Granularity: ordered argv-token PREFIX match, each position a literal or a list of alternatives; optional host_executable(name="git", paths=[...]) pins which absolute paths may match a basename rule. No glob or regex. match/not_match examples are validated at load. Test with codex execpolicy check --rules <file> -- <cmd>.

Policy TOML rule with decision="allow" and commandPrefix (prefix at a word boundary), commandRegex (regex) or argsPattern (regex over the JSON args). Example in ~/.gemini/policies/allow.toml: [[rule]] toolName="run_shell_command" commandPrefix=["git status","npm test"] decision="allow" priority=100. Legacy settings: tools.allowed ["run_shell_command(git)"] or --allowed-tools.

permission.bash object of wildcard patterns -> allow|ask|deny, e.g. {"permission":{"bash":{"*":"ask","git status *":"allow","npm test":"allow"}}}. The command is parsed with tree-sitter (bash/PowerShell). Every command node, including ones nested in pipelines, subshells and command substitutions, is checked against the patterns.

IDE

terminalAllowlist in permissions.json (prefix match; 'base:args-glob' form) or the in-app allowlist. Used by Allowlist and Auto-review modes. Example: {"terminalAllowlist": ["git status", "npm:install*", "cargo test"]}

CLI

permissions.allow with Shell(commandBase) tokens in ~/.cursor/cli-config.json or <project>/.cursor/cli.json. Example: {"permissions": {"allow": ["Shell(git)", "Shell(curl:*)"]}}

Team

Dashboard terminal allowlist (admin-controlled; replaces file/IDE lists). Org Groups union their allowlists.

VS Code

chat.tools.terminal.autoApprove: per-command booleans or /regex/. Rules match each sub-command, or the whole line with {"approve": true, "matchCommandLine": true}. Example: {"chat.tools.terminal.autoApprove": {"mkdir": true, "/^git (status|show\\b.*)$/": true}}. Built-in defaults auto-approve common read-only commands. Prompt approvals can be saved per session, workspace, or user. Agent Host sessions also honour managed permissions.allow ["Shell(git status)"].

CLI

--allow-tool='shell(git:*)' (session only). Saved per-location approvals in ~/.copilot/permissions-config.json, e.g. {"locations":{"/repo":{"tool_approvals":[{"kind":"commands","commandIdentifiers":["git:*"]}]}}}. Managed permissions.allow ["Shell(git push *)"]. Read-only shell commands are auto-allowed.

Cloud agent

Not applicable. All tools are pre-granted.

Cascade

Per-user allow list, managed from the command card dropdown: 'Prefix' adds e.g. git * (token prefix), 'Allow' adds the exact command. Used in 'Allowlist Only' and higher levels. Team-wide allowlist: Admin Portal > Team Settings > Terminal Commands > Manage Lists (Teams & Enterprise), merged with user lists.

Devin local

permissions.allow rules, e.g. {"permissions": {"allow": ["Exec(git)", "Exec(npm run)"]}} in .devin/config.json, .devin/config.local.json, ~/.config/devin/config.json, or org Team Settings.

permissions.deny with Bash(...) rules, or --disallowedTools for one session. Example: {"permissions": {"deny": ["Bash(git push *)", "Bash(curl *)"]}}. A bare Bash deny removes the tool entirely.

prefix_rule(pattern = ["rm"], decision = "forbidden", justification = "Use git clean -fd instead.") in a .rules file, or admin-enforced in requirements.toml: [rules] prefix_rules = [{ pattern = [{ token = "rm" }], decision = "forbidden" }]. Most restrictive decision wins (forbidden > prompt > allow).

Policy TOML rule with decision="deny" (optional denyMessage). Example in /etc/gemini-cli/policies/deny.toml: [[rule]] toolName="run_shell_command" commandPrefix="rm -rf" decision="deny" priority=900 denyMessage="blocked by IT". Deprecated: tools.exclude ["run_shell_command(rm)"].

permission.bash pattern -> "deny", e.g. {"permission":{"bash":{"rm *":"deny","git push *":"deny"}}}. A deny returns an error to the model immediately.

IDE

No user-level hard command denylist is documented for the current (3.5+) Run Modes. Hard blocks come from (a) a beforeShellExecution or preToolUse hook returning {"permission":"deny"} or exiting 2, or (b) the team admin command denylist (dashboard, Enterprise). Auto-review block_instructions only steer a classifier.

CLI

permissions.deny, e.g. {"permissions": {"deny": ["Shell(rm)"]}}. Deny beats allow and beats --force/--yolo. The team admin denylist is also enforced in the CLI.

Team

Admin command denylist (Auto Run Configuration in the dashboard). Commands are rejected before execution, including on paths that skip approval prompts.

VS Code

A false rule in chat.tools.terminal.autoApprove only forces a prompt; it does not block. To hard-block: a PreToolUse hook returning permissionDecision 'deny' (Local harness) or the Copilot hook format (Agent Host). Agent Host sessions also honour managed permissions.deny ["Shell(rm -rf *)"].

CLI

--deny-tool='shell(git push)' (session; beats --allow-all and saved approvals). Managed permissions.deny. preToolUse or permissionRequest hook deny. permissions-config.json cannot hold deny rules.

Cloud agent

preToolUse hook in .github/hooks/*.json returning deny. Custom agents can also restrict 'tools'.

Cascade

No hard deny list. The 'deny list' (user and team) only forces approval. Hard blocking needs a pre_run_command hook that exits with code 2.

Devin local

permissions.deny, e.g. "Exec(rm)". Deny wins over every allow. Org deny rules cannot be overridden by project or user config and stay active in Smart, Bypass and Autonomous modes.

permissions.ask with Bash(...) rules. Example: {"permissions": {"ask": ["Bash(git push *)", "Bash(dangerouslyDisableSandbox:true)"]}}

prefix_rule(pattern = ["git", ["push", "commit"]], decision = "prompt") in .rules, or requirements.toml [rules] prefix_rules with decision = "prompt".

Policy TOML rule with decision="ask_user" at user or admin tier. Example: [[rule]] toolName="run_shell_command" commandPrefix="git push" decision="ask_user" priority=500. Tool-level only: settings tools.confirmationRequired ["write_file"] (priority 4.35, above allowed/core).

permission.bash pattern -> "ask", e.g. {"permission":{"bash":{"*":"allow","git push *":"ask"}}}

IDE

beforeShellExecution / beforeMCPExecution hooks returning {"permission":"ask"}. Auto-review autoRun.block_instructions in permissions.json: since 3.24, commands the classifier matches to a block instruction always show the approval card. Built-in protections (File-Deletion, External-File, Browser) force approval even when the mode would auto-run.

CLI

No 'ask' list in cli-config.json is documented. Hooks only.

VS Code

chat.tools.terminal.autoApprove false rules (under Manual permissions). chat.tools.eligibleForAutoApproval {"execute/runInTerminal": false} forces approval per tool, not per command; the ChatToolsEligibleForAutoApproval policy does the same. PreToolUse hooks can return 'ask'. Managed permissions.ask applies to Agent Host sessions.

CLI

Managed permissions.ask, e.g. {"permissions":{"ask":["Shell(git push *)"]}}. preToolUse hook permissionDecision 'ask'.

Cloud agent

None. 'ask' is treated as 'deny'.

Cascade

The user deny list and the team denylist both force approval, including in Turbo mode. A team denylist entry prompts 'regardless of user settings'.

Devin local

permissions.ask, e.g. {"permissions":{"ask":["exec"],"allow":["Exec(git status)"]}}. Org ask rules apply in every permission mode.

Same allow/ask/deny arrays with tool-specific specifiers: Read(path) (Read, Grep, Glob, LSP), Edit(path) (Edit, Write, NotebookEdit), WebFetch(domain:host), WebSearch (bare only), Agent(SubagentName), Skill(name), mcp__server__tool, PowerShell(...), Cd(path). Deny/ask rules can match any top-level scalar input parameter, e.g. Agent(model:opus) or Bash(run_in_background:true); deny/ask accept tool-name globs such as "*" or "mcp__*". --tools restricts the built-in tool set. Example: {"permissions": {"deny": ["WebSearch", "Agent(Explore)", "Edit(//etc/**)"], "allow": ["WebFetch(domain:docs.python.org)"]}}

No unified allow/ask/deny list for built-in non-shell tools was found. Separate per-surface switches: file edits (apply_patch) follow the sandbox + approval_policy (writes outside writable roots need approval); web_search = "disabled" | "cached" | "indexed" | "live"; tools.view_image = false; [features] multi_agent = false (sub-agents), shell_tool = false; MCP/app tools via approval_mode (see mcp_tool_rules); approval_policy = { granular = { sandbox_approval, rules, mcp_elicitations, request_permissions, skill_approval } } auto-rejects whole prompt categories; Browser Use / Computer Use have their own requirements. A PreToolUse hook can block any local function tool by name (e.g. matcher "apply_patch|Edit|Write").

Policy TOML rules keyed by toolName (read_file, read_many_files, write_file, replace, glob, grep_search, list_directory, web_fetch, google_web_search, activate_skill, ask_user, enter/exit_plan_mode, invoke_agent / subagent name, MCP tools) with allow | ask_user | deny, optional argsPattern regex over JSON args, modes, interactive, subagent and toolAnnotations. Example: [[rule]] toolName="write_file" argsPattern='"file_path":".*\\.env"' decision="deny" priority=500. Settings: tools.core (allowlist of built-in tools; everything else denied), tools.exclude (deprecated).

permission keys: read, edit (covers write/edit/apply_patch), glob, grep, list, bash, task (pattern = subagent type), skill, lsp, question, webfetch, websearch, todowrite, external_directory, doom_loop, plus any custom/MCP tool name. Each is a string action or a {pattern: action} map. Example: {"permission":{"edit":{"*":"ask","docs/*.md":"allow"},"task":{"*":"deny","explore":"allow"},"webfetch":"ask"}}. Also per agent, and the legacy tools: {name: false} maps to deny.

IDE

No general per-tool allow/ask/deny file. Available pieces: mcpAllowlist (MCP auto-run), Fetch and MCP calls go through Run Modes, Browser Protection, File-Deletion Protection, External-File Protection, Read Access (System|Workspace) with a Read Allowlist, .cursor Directory Protection and Browser origin allowlist (Enterprise dashboard), and preToolUse hooks with matcher Shell|Read|Write|Grep|Delete|Task|MCP:<tool>. subagentStart hooks can deny sub-agents.

CLI

Typed rules in permissions.allow/deny: Shell(...), Read(glob), Write(glob), WebFetch(domain), Mcp(server:tool). Example: {"permissions":{"deny":["Read(.env*)","Write(**/*.key)","WebFetch(malicious-site.com)"]}}. Optional autoAcceptWebSearch.

Team

Model access, browser origin controls, .cursor Directory Protection, MCP tool controls per server.

VS Code

Tools picker (enable/disable tools). Chat: Manage Tool Approval gives pre-approval and post-approval per tool or per MCP server/extension. chat.tools.eligibleForAutoApproval. URL request/response approvals via chat.tools.urls.autoApprove. chat.tools.edits.autoApprove globs, e.g. {"**/.env": false}. Policies: ChatAgentExtensionTools, BrowserChatTools, ChatAgentMode. Managed Read()/Edit()/Domain() rules (Agent Host).

CLI

--available-tools / --excluded-tools hide tools from the model. --allow-tool / --deny-tool with kinds shell, read, write, url, memory, MCP-SERVER(tool). User settings allowedUrls / deniedUrls and subagents.disabledSubagents. Managed Read/Edit/Write/Domain rules. Custom agent 'tools'.

Cloud agent

Custom agent profile 'tools' list (aliases; [] disables all). Repo MCP config 'tools' array. Automations choose which tools they can use.

Cascade

No general per-tool allow/deny. Pieces available: the admin 'Web search' toggle (when off, the search tool is removed server-side and every page read needs manual approval); page-read approvals ('Always allow this page', 'Allow all requests'); MCP server toggles and disabledTools; the admin 'Restrict Cascade to workspace'; pre_read_code, pre_write_code and pre_mcp_tool_use hooks; Chat mode (no edits).

Devin local

Typed rules: Read(glob), Write(glob), Exec(prefix), Fetch(URLPattern), mcp__server__tool, and tool names read/edit/grep/glob/exec, each in allow/ask/deny. Admin default subagent model can be set to 'none' to disable subagents.

permissions.deny Read rules (gitignore syntax; // = absolute, ~/ = home, / = relative to settings source). Example: {"permissions": {"deny": ["Read(./.env)", "Read(./.env.*)", "Read(~/.ssh/**)"]}}. With sandbox.enabled true, Read deny rules are also added to the sandbox's denyRead list, so they become OS-level for shell commands too; sandbox-only keys: sandbox.filesystem.denyRead or sandbox.credentials.files [{"path": "~/.ssh", "mode": "deny"}] with sandbox.enabled true. permissions.blockReadsOutsideWorkingDirectories: true refuses file-tool reads outside working directories in every mode.

Permission profiles (beta): default_permissions = "project-edit"; [permissions.project-edit] extends = ":workspace"; [permissions.project-edit.filesystem] "~/.ssh" = "deny"; [permissions.project-edit.filesystem.":workspace_roots"] "**/*.env" = "deny" (set glob_scan_max_depth for unbounded ** on Linux/WSL/Windows). Admin-enforced: requirements.toml [permissions.filesystem] deny_read = ["/**/*.env", "~/.ssh"].

(a) Built-in file tools can only read inside the workspace dirs (cwd + context.includeDirectories / --include-directories) and the project temp dir, so ~/.ssh is out of reach unless included. (b) .geminiignore / context.fileFiltering.customIgnoreFilePaths: read_file refuses ignored paths. (c) Policy deny with argsPattern, e.g. [[rule]] toolName=["read_file","read_many_files"] argsPattern='\.env' decision="deny". (d) With tool sandboxing on (security.toolSandboxing=true or a sandbox), .geminiignore'd paths become sandbox forbidden paths.

permission.read patterns (matched against the path relative to the worktree), e.g. {"permission":{"read":{"*":"allow","*.env":"deny","secrets/*":"deny"}}}. For paths outside the project use external_directory with absolute or ~ globs, e.g. {"permission":{"external_directory":{"~/.ssh/*":"deny"}}}.

IDE

.cursorignore at the repo root (gitignore syntax), optional Hierarchical Cursor Ignore, a global ignore list in user settings, and team 'Cursor Ignore Configuration' (Enterprise). .gitignore'd files and a default list (including .env*) are ignored. A beforeReadFile hook can deny reads, and receives the file content. Read Access 'Workspace' (3.23+) or sandbox.json {"readBoundary":"workspace"} asks before reads outside the workspace.

CLI

permissions.deny Read(glob), e.g. "Read(.env*)". sandbox.readBoundary in cli-config.json.

VS Code

Copilot content exclusion (org/enterprise/repo settings on github.com) is NOT supported in VS Code agent mode. Built-in agent tools are limited to the workspace (plus chat.additionalReadAccessFolders). Agent Host: managed permissions.deny ["Read(**/.env)"] and sandbox deniedPaths (terminal, when sandbox is on). PreToolUse hooks.

CLI

Content exclusion: docs conflict (see limits). --deny-tool='read(.env)'. Managed Read(...) deny. sandbox.userPolicy.filesystem.deniedPaths for sandboxed commands. preToolUse hook on 'view'.

Cloud agent

Not documented in the pages reviewed (unknown).

Cascade

.devinignore at the repo root (gitignore syntax; legacy .codeiumignore and .windsurfignore still read) and a global ~/.codeium/.codeiumignore. .gitignore'd paths are not indexed or editable ('Gitignore access' is off by default). pre_read_code hook (exit 2 blocks; also fires for directory reads).

Devin local

Read(...) deny rules. With the sandbox on, these also hide the paths from sandboxed shell commands.

File tools: writes outside the working directory and additionalDirectories prompt in Manual/acceptEdits; Edit allow/deny rules (e.g. "deny": ["Edit(//etc/**)"]); protected paths (.git, .claude, .vscode, shell rc files, .mcp.json, etc.) never auto-approved outside bypassPermissions. Shell: with sandbox.enabled true, writes are OS-limited to cwd, a per-user temp dir and added directories; widen with sandbox.filesystem.allowWrite, narrow with denyWrite. --restricted confines file tools to the working directories.

sandbox_mode = "workspace-write" (cwd/workspace roots plus $TMPDIR and /tmp unless excluded) with [sandbox_workspace_write] writable_roots = ["/path"], exclude_tmpdir_env_var, exclude_slash_tmp; --add-dir <DIR>; sandbox_mode = "read-only"; or permission profiles with per-path "read" | "write" | "deny". Requirements: allowed_sandbox_modes, allowed_permission_profiles (0.138.0+), managed default_permissions.

write_file / replace validate that paths are inside the workspace dirs or the project temp dir. Narrow further with policy argsPattern on file_path. For shell writes, enable the OS sandbox: tools.sandbox=true|"sandbox-exec"|"docker"... (seatbelt default confines writes to the project dir), or security.toolSandboxing=true, plus tools.sandboxAllowedPaths for extra paths.

permission.edit patterns (relative to the worktree) plus external_directory for anything outside the start directory. Example: {"permission":{"edit":{"*":"deny","src/**":"allow"},"external_directory":{"*":"deny"}}}. The plan agent denies edits except plan files.

IDE

External-File Protection prompts before creating, changing, or deleting files outside the workspace. Sandboxed commands get workspace_readwrite by default; sandbox.json type can be "workspace_readonly" and additionalReadwritePaths adds paths. A hardcoded write-protected list applies inside the sandbox (.cursor/*.json, .vscode/**, .git/hooks/**, .git/config, .cursorignore). Enterprise .cursor Directory Protection.

CLI

permissions Write(glob) allow/deny, e.g. "Write(src/**)" or deny "Write(**/.env*)".

VS Code

Built-in tools write only inside the workspace. chat.tools.terminal.blockDetectedFileWrites defaults to 'outsideWorkspace' (prompts for detected terminal writes outside the workspace). Agent Host sandbox readwritePaths/readonlyPaths/deniedPaths. Managed Edit() deny.

CLI

A path gate covers trusted dir, --add-dir and allowed_directories; --allow-all-paths disables it. --deny-tool='write(PATH)'. Managed Edit()/Write() rules, which also catch recognised shell redirections and sed -i. Sandbox readwrite lists. /plan blocks edits.

Cloud agent

Ephemeral runner. It can push only to its own copilot/ branch (or the PR branch it was invoked on), subject to branch protection.

Cascade

Admin 'Restrict Cascade to workspace' (Teams & Enterprise) limits reads and writes to the open workspace. .devinignore and .gitignore paths cannot be edited. pre_write_code hook.

Devin local

By default edits only inside the workspace (Accept Edits auto-approves only there). Write(glob) rules. The sandbox writable roots come from permission scopes.

Shell commands: sandbox.network.allowedDomains / deniedDomains (exact hosts, leading *. wildcards, IPs, optional :port) enforced by a local proxy; sandbox.network.strictAllowlist (user/managed/--settings) and managed-only sandbox.network.allowManagedDomainsOnly refuse unlisted hosts without prompting. WebFetch tool: WebFetch(domain:...) allow/ask/deny rules (also merged into the sandbox lists). WebSearch: whole-tool allow/deny only. Example: {"sandbox": {"enabled": true, "network": {"allowedDomains": ["github.com", "*.npmjs.org"]}}, "permissions": {"deny": ["WebSearch"]}}

Shell commands: [sandbox_workspace_write] network_access = true|false (default off), or permission profile [permissions.<p>.network] enabled = true. Domain allow-list: [features.network_proxy] enabled = true, domains = { "api.openai.com" = "allow", "example.com" = "deny" } (exact host, *.example.com, **.example.com, global * allow; deny wins; local/private IPs blocked unless allow_local_binding or an exact allow; unix_sockets allowlist). Admin: requirements.toml [experimental_network] enabled, domains / allowed_domains / denied_domains, managed_allowed_domains_only = true. Web search: web_search = "disabled" | "cached" (default) | "indexed" | "live" (--search), tools.web_search.allowed_domains filters results; managed allowed_web_search_modes.

Shell: tools.sandboxNetworkAccess (bool, default false; applies to the sandbox) and SEATBELT_PROFILE=*-proxied / restrictive-* on macOS. The tool sandbox's default policy has network=false per mode. Web tools: web_fetch blocks private, loopback and reserved IPs and pins the resolved IP. Allow/ask/deny web_fetch and google_web_search via policy, and regex-match URLs with argsPattern on the prompt arg. Example: [[rule]] toolName="web_fetch" decision="deny" priority=500. Browser agent: agents.browser.allowedDomains ["github.com","*.google.com"].

Web tools only: {"permission":{"webfetch":"deny","websearch":"deny"}} (or ask). Proxies via HTTPS_PROXY / HTTP_PROXY / NO_PROXY and NODE_EXTRA_CA_CERTS.

Sandboxed terminal

Network modes: 'sandbox.json Only', 'sandbox.json + Defaults' (default), 'Allow All'. sandbox.json: {"networkPolicy": {"default": "deny", "allow": ["registry.npmjs.org"], "deny": ["*.internal.corp.example.com"]}}. Domains, wildcards, CIDR. RFC1918, loopback, and cloud metadata are blocked by default.

Team

A team-admin network allowlist replaces the user/repo union. The CLI changelog says admin network allow/deny lists are enforced unconditionally, including MCP traffic. Per-MCP-server network mode (Allow all / Allowlist / Deny all / No sandbox) and a browser origin allowlist (Enterprise).

Web tools

IDE Fetch calls go through Run Modes (allowlist or classifier). CLI: WebFetch(domain) allow/deny; without an allow entry each fetch prompts.

VS Code

URL two-step approval (request and response) via chat.tools.urls.autoApprove and Trusted Domains. chat.agent.networkFilter with chat.agent.allowedNetworkDomains / deniedNetworkDomains (fetch tool, integrated browser; terminal coverage varies). Agent Host sandbox: chat.agent.sandbox.network.allowNetwork (default true), allowedDomains / deniedDomains. Policies: ChatAgentNetworkFilter, ChatAgentAllowedNetworkDomains, ChatAgentDeniedNetworkDomains.

CLI

--allow-url / --deny-url, allowedUrls / deniedUrls (url rules also cover URLs detected in shell commands). Sandbox allowedHosts / blockedHosts through a local proxy. Managed Domain() rules and permissions.limitTo, e.g. {"permissions":{"limitTo":["github.com","*.github.com"]}}. web_fetch blocks private, loopback, and metadata IPs.

Cloud agent

Firewall on by default with a recommended allowlist. Org and repo 'Internet access' settings: Enabled / Disabled / Let repositories decide; custom allowlists of domains or URL prefixes; orgs can stop repos adding rules.

Cascade

Web tools only: the admin 'Web search' toggle (disabled by default for enterprise teams) and per-page read approvals. No documented network control for Cascade terminal commands.

Devin local

Sandbox network filtering with domain allow and deny lists. Org 'Sandbox domains' is authoritative and replaces user allowed_domains. Fetch(URLPattern) rules.

Built-in Bash sandbox on @anthropic-ai/sandbox-runtime: macOS Seatbelt; Linux and WSL2 bubblewrap + socat (optional seccomp filter for Unix sockets); native Windows not supported. Off by default. Keys: sandbox.enabled, failIfUnavailable, autoAllowBashIfSandboxed (default true), allowUnsandboxedCommands (default true), excludedCommands, filesystem.{allowWrite,denyWrite,denyRead,allowRead,disabled,allowManagedReadPathsOnly}, network.{allowedDomains,deniedDomains,strictAllowlist,allowManagedDomainsOnly,...}, credentials.{files,envVars} (deny or mask), enableWeakerNestedSandbox, enableWeakerNetworkIsolation, allowAppleEvents. Example managed enforcement: {"sandbox": {"enabled": true, "failIfUnavailable": true, "allowUnsandboxedCommands": false}}

sandbox_mode = "read-only" | "workspace-write" | "danger-full-access" (-s/--sandbox), or default_permissions = ":read-only" | ":workspace" | ":danger-full-access" | custom profile. macOS: Seatbelt via sandbox-exec. Linux/WSL2: bubblewrap + seccomp, Landlock for compatibility fallback; bundled bwrap helper needs unprivileged user namespaces. Windows: MXC ([features] prefer_mxc = true) with legacy [windows] sandbox = "elevated" | "unelevated". Test with codex sandbox macos|linux|windows -- <cmd>.

Whole-process sandbox: tools.sandbox = true | "sandbox-exec" | "docker" | "podman" | "runsc" | "lxc" | "windows-native" | {enabled, command, image, allowedPaths, networkAccess}; or GEMINI_SANDBOX env or --sandbox/-s. macOS seatbelt profiles via SEATBELT_PROFILE (permissive-open default, permissive-proxied, restrictive-open/proxied, strict-open/proxied, or a custom .gemini/sandbox-macos-<name>.sb). Tool-level sandbox: security.toolSandboxing=true (Linux, macOS and Windows managers).

None built in. The project recommends running OpenCode inside Docker or a VM.

IDE

OS sandbox for agent terminal commands: macOS Seatbelt (sandbox-exec, Cursor 2.0+); Linux Landlock + seccomp (kernel 6.2+, unprivileged user namespaces). Auto-review (the default since 3.6) sandboxes non-allowlisted shell commands when it can. Allowlist mode sandboxing is optional. Run Everything has no sandbox. Configure via ~/.cursor/sandbox.json and <workspace>/.cursor/sandbox.json, e.g. {"type": "workspace_readonly", "disableTmpWrite": true}.

CLI

--sandbox enabled|disabled, agent sandbox enable|disable|run, cli-config sandbox.mode / sandbox.networkAccess. The CLI fails fast when sandboxing is enabled but unavailable.

Team

Admins set Sandboxing Mode, Sandbox Networking, Sandbox Git Access, and Read Controls. For Org Groups the loosest setting wins.

Cloud agents

Cloud Agents run in dedicated VMs, auto-run commands, and do not use Run Modes. Egress is set on the Cloud Agents dashboard.

VS Code

Agent Host sandbox: chat.agent.sandbox.enabled 'off' (default) or 'on'. Covers terminal commands and, by default, Agent Host-launched MCP and LSP servers. chat.agent.sandbox.allowUnsandboxedCommands defaults to true. Per-session toggle. Managed sandbox.enabled locks it (1.138+/1.140+ per GitHub docs). Legacy Local-harness sandbox settings and policies are deprecated.

CLI

OS sandbox through Microsoft eXecution Container: Seatbelt (macOS), bubblewrap (Linux), ProcessContainer (Windows 11). sandbox.enabled defaults to false. Enable with /sandbox enable or --sandbox. sandbox.allowBypass defaults to true. Managed floor: enabled, failIfUnavailable, allowBypass:false, sandboxMcpServers. Optional cloud sandboxes (preview, billed, off by default for orgs).

Cloud agent

Each job runs in an ephemeral GitHub Actions environment behind the agent firewall.

Cascade

None documented. OS sandboxing is listed as a Devin Local improvement over Cascade, and the admin 'Devin Sandbox' control covers Devin CLI and Devin Local only.

Devin local

Optional OS-level sandbox (filesystem isolation + network filtering), Autonomous permission mode via --sandbox. Org 'Devin Sandbox' setting: Optional (default) or Required (Enterprise). Fails closed and refuses to start if the sandbox can't be set up. Not supported on Windows.

Modes (config value / UI label): default (Manual; alias manual), acceptEdits, plan, auto (classifier model reviews actions), dontAsk (anything that would prompt is denied), bypassPermissions. Set with permissions.defaultMode, --permission-mode <mode>, --dangerously-skip-permissions (= bypassPermissions), --allow-dangerously-skip-permissions (adds bypass to the Shift+Tab cycle), --permission-prompts none (-p: deny anything that would prompt), --permission-prompt-tool, --restricted. VS Code: claudeCode.initialPermissionMode and claudeCode.allowDangerouslySkipPermissions. Built-in default since v2.1.283: auto for interactive terminal and VS Code sessions; -p/SDK default is default (auto in sessions that do not fetch feature flags, v2.1.285+). Example: {"permissions": {"defaultMode": "acceptEdits"}}

approval_policy = "on-request" (default; alias on-failure is deprecated) | "never" | { granular = { sandbox_approval, rules, mcp_elicitations, request_permissions, skill_approval } }. The explicit value "untrusted" is retired since 0.149.0 and rejected at load; it survives only as the internal policy for projects marked trust_level = "untrusted". approvals_reviewer = "user" | "auto_review" (CLI --approve-for-me, alias --not-so-yolo). CLI: -a/--ask-for-approval on-request|never; -s/--sandbox read-only|workspace-write|danger-full-access; --dangerously-bypass-approvals-and-sandbox (alias --yolo) = danger-full-access + never; --profile <name>; /permissions in the TUI. codex exec defaults to approval never. --full-auto was removed from codex exec in 0.147.0 and does not exist in source at HEAD or at rust-v0.162.1, although the security docs still call it a deprecated compatibility path.

Modes: default (prompt), auto_edit (auto-approves write_file, replace, web_fetch; shell still asks), plan (read-only), yolo (allow-all rule at default tier). Set by --approval-mode=default|auto_edit|plan|yolo, --yolo/-y, settings general.defaultApprovalMode (default|auto_edit|plan only), and at runtime Shift+Tab (cycles default/auto_edit/plan) and Ctrl+Y (toggles yolo). Related: security.enablePermanentToolApproval ('Allow for all future sessions', persisted to ~/.gemini/policies/auto-saved.toml), security.disableAlwaysAllow.

Two client-side modes: normal (ask rules prompt) and auto (--auto on opencode or opencode run; hidden aliases --yolo and --dangerously-skip-permissions; TUI command palette 'Enable auto-approve permissions'). Headless opencode run without --auto auto-rejects asks. Agents act as modes: build (default, permissive) and plan (edits denied), selected with --agent or default_agent. Prompt replies are once | always (session-scoped prefix approvals) | reject.

IDE

Settings > Agents > Approvals & Execution: Auto-review (default since 3.6; allowlist, then sandbox, then LLM classifier on the Cursor backend), Allowlist (optional sandbox; an empty allowlist reproduces the deprecated 'Ask Every Time'), Run Everything (no prompts, no sandbox). Separate Read Access: System (default) or Workspace.

CLI

approvalMode in ~/.cursor/cli-config.json: "allowlist" | "auto-review" | "unrestricted". Flags: -f/--force and --yolo (Run Everything; also auto-approves trust and MCP), --auto-review, --approve-mcps, --trust, --sandbox. Slash commands /auto-run and /auto-review. -p/--print has access to write and shell tools.

Cloud agents

Always auto-run; no approval modes.

VS Code

Permission levels: Manual (default), Assisted (LLM judge; Agent Host; chat.assistedPermissions.enabled), Allow all. Autopilot is a mode (Agent Host) or level (extension host) that auto-approves. chat.tools.global.autoApprove (global 'YOLO'; scope APPLICATION_MACHINE). /yolo and /autoApprove per session. chat.permissions.default: 'default' | 'autoApprove' | 'autopilot'. chat.defaultConfiguration.approvals. chat.tools.terminal.enableAutoApprove. Claude harness: github.copilot.chat.claudeAgent.allowDangerouslySkipPermissions.

CLI

Interactive prompts by default. --allow-all-tools, --allow-all-paths, --allow-all-urls, --allow-all / --yolo, /allow-all and /yolo, /permissions assisted (/allow-all auto; LLM judge), --autopilot / --mode autopilot (auto-handles permission prompts), --plan --mode autopilot. COPILOT_ALLOW_ALL=true env. defaultPermissionMode setting (added 1.0.81).

Cloud agent

No modes. Every tool is pre-approved.

Cascade

Auto-execution levels in the Devin Settings panel: Disabled, Allowlist Only, Auto (model judges; premium models only), Turbo (everything except the deny list). The admin controls page calls them 'No auto-approvals, Allowlist only, Smart, Bypass'. Web page reads: 'Allow all requests'. Auto-Continue (devin.autoContinue in settings.json) removes the per-prompt invocation cap.

Devin local

Permission modes: Normal (default), Accept Edits, Smart (LLM judge with hard exclusions), Bypass (all auto-approved), Autonomous (only with sandbox). Set via --permission-mode, DEVIN_PERMISSION_MODE, the mode selector, or Shift+Tab.

permissions.disableBypassPermissionsMode: "disable" (rejects --dangerously-skip-permissions, ignores agent frontmatter permissionMode: bypassPermissions, makes hook setMode bypass a no-op) and permissions.disableAutoMode (or top-level disableAutoMode): "disable". Put them in managed settings so lower scopes cannot remove them. Example: {"permissions": {"disableBypassPermissionsMode": "disable", "disableAutoMode": "disable"}}. --restricted (or CLAUDE_CODE_RESTRICTED=1 in the launch environment) also refuses bypassPermissions. Desktop on Team/Enterprise: organization policy controls the bypass toggle.

requirements.toml: allowed_approval_policies = ["untrusted", "on-request"]; allowed_sandbox_modes = ["read-only", "workspace-write"] (blocks -a never, -s danger-full-access and --yolo); for profile deployments [allowed_permission_profiles] ":read-only" = true, ":workspace" = true (omitted = denied, 0.138.0+); also allowed_approvals_reviewers, allowed_web_search_modes, remote_sandbox_config[].hostname_patterns. Delivery: /etc/codex/requirements.toml, %ProgramData%\OpenAI\Codex\requirements.toml, macOS MDM requirements_toml_base64, cloud-managed Agent Security policy, legacy managed_config.toml.

(1) security.disableYoloMode=true in the system settings file: --yolo then exits with a fatal error and Ctrl+Y is refused. (2) Enterprise remote admin control 'Strict Mode' (admin.secureModeEnabled, default enabled when admin controls apply) blocks yolo and 'Always allow'. (3) Admin-tier TOML in the root-owned system policies dir: deny/ask rules there outrank the yolo allow-all, e.g. [[rule]] toolName="*" decision="ask_user" modes=["yolo"] priority=999. (4) security.disableAlwaysAllow=true.

No setting disables --auto or the TUI auto-approve toggle. The nearest control is managed config deny rules (managed files or macOS MDM), which auto mode still honours.

Team

Team dashboard Run Mode policy (Auto Run Configuration, listed under Enterprise-only settings) sets which modes members can choose. Admins can gate Auto-review and disable headless CLI usage. Admin-controlled allowlists replace user and repo lists.

CLI

Team-configured approval modes are respected in headless runs (CLI changelog). Admins can block non-interactive CLI usage.

Mdm

None for Run Mode. MDM covers only workspace trust, extensions, team ID, updates, and HTTP/2.

Managed settings

{"permissions": {"disableBypassPermissionsMode": "disable"}} (or "allow-auto-only"), via server-managed, MDM, or file. CLI: suppresses --allow-all-tools/-paths/-urls, --allow-all, --yolo, /allow-all and /yolo; an unrecognised value fails closed to 'disable'; re-fetched hourly. VS Code: turns off chat.tools.global.autoApprove. Copilot app: blocks 'Allow all'. Supported on JetBrains too. Overridable per enterprise team via {"overridable": "disable"}.

Vscode policy

ChatToolsAutoApprove=false disables global auto-approve and hides Assisted, Allow all and Autopilot. ChatToolsTerminalEnableAutoApprove=false. ChatAgentMode=false disables agents.

Cloud agent

No bypass mode exists. Admins can block the cloud agent in all enterprise repositories.

Cascade

Team setting 'Maximum autonomy level' (Teams & Enterprise). Members can choose any level up to the max. For example, max 'Auto' makes Turbo unavailable. 'Enable Cascade' (Enterprise) can disable Cascade entirely.

Devin local

No toggle to disable Bypass is documented. Admins instead enforce org deny/ask rules (active in all modes) and can make the sandbox Required, which leaves Autonomous as the only permission mode (Bypass hidden).

allowedMcpServers / deniedMcpServers entries with exactly one of serverName, serverCommand (exact argv array) or serverUrl (wildcard pattern); managed-only allowManagedMcpServersOnly: true locks the allowlist to managed values; managed-mcp.json gives exclusive control (empty map disables MCP); managedMcpServers provides servers; strictPluginOnlyCustomization ["mcp"]; disableSideloadFlags rejects --mcp-config; disabledMcpjsonServers rejects .mcp.json servers; --strict-mcp-config. Example: {"allowManagedMcpServersOnly": true, "allowedMcpServers": [{"serverName": "github"}, {"serverUrl": "https://mcp.example.com/*"}], "deniedMcpServers": [{"serverCommand": ["npx", "-y", "evil-mcp"]}]}

requirements.toml: [mcp_servers.docs] identity = { command = "codex-mcp" }; [mcp_servers.remote] identity = { url = "https://example.com/mcp" }; structured form identity.command = { executable = "/usr/local/bin/codex-mcp", args = [{ match = "exact", value = "serve" }, { match = "prefix", value = "--workspace=" }] }; URL matchers exact | prefix | regex. Plugin servers: plugins.<plugin>.mcp_servers.<server>. User-side: mcp_servers.<id>.enabled = false.

By server name: mcp.allowed ["corp-api"] / mcp.excluded ["x"] in settings, or --allowed-mcp-server-names. Servers not on the allowlist are not started. Enterprise remote admin: admin.mcp.enabled=false disables MCP; the admin.mcp.config allowlist matches by name and forces url/type/trust and clears local command/args/env; admin.mcp.requiredConfig injects servers. Recommended locking pattern: define the servers and mcp.allowed in the system settings file.

Per server name only: mcp.<name>.enabled=false, e.g. {"mcp":{"jira":{"type":"remote","url":"...","enabled":false}}}. Remote org config can ship servers disabled by default. Tool-level hiding: permission {"<server>_*": "deny"}.

Team

Enterprise: Team Settings > MCP Configuration allowlist. Command entries match the full stdio command string with * wildcards, e.g. '*npx -y @acme/mcp-tool@latest'. URL entries match remote URLs, e.g. 'https://mcp.acme.com/*'. Optional 'Allow User Extension' plus a User MCP Network Denylist. Team marketplaces distribute servers.

User

Each MCP connection needs approval. Project .cursor/mcp.json servers still need approval in the CLI. CLI: agent mcp enable/disable; --approve-mcps auto-approves all servers.

Managed settings

{"allowedMcpServers": [{"serverUrl": "https://mcp.example.com/*"}, {"serverCommand": ["npx","-y","@example/mcp-server"]}], "deniedMcpServers": [{"serverName": "untrusted"}]}. Lists are intersected and unioned across sources, deny wins, first-party servers are exempt, and servers with unresolved ${VAR} are blocked. Supported: CLI, VS Code, Copilot app, JetBrains. Not the cloud agent.

Github policy

'MCP servers in Copilot' policy (on/off). 'Restrict MCP access to registry servers' + MCP Registry URL (preview; name-based).

VS Code

ChatMCP policy (registryOnly / off), McpGalleryServiceUrl. MCP server trust prompts for non-workspace servers.

CLI

Workspace .mcp.json / .github/mcp.json only after folder trust. disabledMcpServers. Enterprise allowlist evaluation is fail-closed.

Cloud agent

Repo admins configure servers in repo settings. Registry enforcement is not supported for the cloud agent.

Cascade

Team settings 'Allow MCP' toggle and 'MCP allowlist' (Teams & Enterprise). Once one server is allowlisted, all others are blocked. Entries are a Server ID with an optional Server Config JSON whose command and args are matched as anchored regexes. Cascade MCP config is user-level only (~/.config/devin/mcp_config.json). There is no workspace-level file for Cascade.

Devin local

MCP allowlist plus MCP registry URLs with an 'MCP registry enforcement' toggle. Registries do not affect Cascade.

Permission rules on MCP tool names: mcp__<server> or mcp__<server>__* (all tools of a server), mcp__<server>__<tool>, globs such as mcp__github__get_*; deny/ask may use "mcp__*". Example: {"permissions": {"allow": ["mcp__github__get_*"], "deny": ["mcp__github__delete_repo"]}}. Parameter-level rules for MCP tools only via --disallowedTools. Servers can mark tools _meta["anthropic/requiresUserInteraction"] to force a prompt every call.

[mcp_servers.<id>] enabled_tools = ["open"], disabled_tools = ["screenshot"] (deny applied after allow), default_tools_approval_mode = "auto" | "prompt" | "writes" | "approve"; [mcp_servers.<id>.tools.<tool>] approval_mode = "prompt". Same keys under plugins.<plugin>.mcp_servers.<server>. Managed: apps.<id>.tools.<tool>.approval_mode (connectors). PreToolUse hooks can block by matcher "mcp__server__tool".

Policy TOML with mcpName (+ toolName) or FQN wildcards mcp_<server>_<tool>, mcp_<server>_*, mcp_*. Example: [[rule]] mcpName="my-jira" toolName="delete_issue" decision="deny" priority=500. Per-server includeTools / excludeTools in mcpServers.<name>. mcpServers.<name>.trust=true auto-approves all of that server's tools. Rules can also match toolAnnotations (e.g. readOnlyHint).

MCP tools are permission keys named <server>_<tool> (sanitised), so wildcard keys work: {"permission":{"github_*":"ask","github_delete_repo":"deny"}}. Legacy tools: {"mymcp_*": false}.

IDE

mcpAllowlist in permissions.json (auto-run allowlist only), patterns 'server:tool', 'server:*', '*:tool', '*:*', e.g. {"mcpAllowlist": ["github:*", "linear:list_issues"]}. Deny or ask via beforeMCPExecution hooks (allow/deny/ask, input includes mcp_server_name and tool_input). Admin per-server Tools field.

CLI

Mcp(server:tool) in permissions.allow / permissions.deny, e.g. "Mcp(datadog:*)".

VS Code

Chat: Manage Tool Approval per tool or per server (pre and post approval). chat.tools.eligibleForAutoApproval. PreToolUse hooks.

CLI

--allow-tool='MyMCP(create_issue)', --deny-tool='MyMCP(delete_issue)'. Saved {"kind":"mcp","serverName":"x","toolName":null|"tool"}. preToolUse / permissionRequest hooks.

Cloud agent

'tools' array per server in the repo MCP config, e.g. "tools": ["get_issue"] or ["*"].

Cascade

disabledTools array per server in mcp_config.json, e.g. {"mcpServers":{"github":{"command":"npx","disabledTools":["delete_repo"]}}}. pre_mcp_tool_use hook (exit 2 blocks). Cascade does not prompt before MCP tool calls by default.

Devin local

mcp__server__tool, mcp__server__* and mcp__* in allow/ask/deny. Prompts before any MCP tool by default. Admins can default-allow servers or tools.

hooks.PreToolUse (fires for every tool, including MCP tools, except EndConversation). Input on stdin (or HTTP POST body): session_id, prompt_id, transcript_path, cwd, permission_mode, hook_event_name, tool_name, tool_input, tool_use_id, plus mcp_server {name, source} for MCP tools. Block by exiting 2 (stderr becomes the reason) or by printing JSON {"hookSpecificOutput": {"hookEventName": "PreToolUse", "permissionDecision": "deny", "permissionDecisionReason": "..."}}; other decisions: ask, allow, defer (-p only), and updatedInput rewrites the call. Other blocking events: PermissionRequest (decision.behavior allow/deny), UserPromptSubmit, UserPromptExpansion, ConfigChange (not for policy_settings), PostToolBatch, PreCompact, PreModelSwitch, Elicitation, Stop/SubagentStop/TaskCompleted. Handler types: command, http, mcp_tool, prompt, agent. Example: {"hooks": {"PreToolUse": [{"matcher": "Bash", "hooks": [{"type": "command", "command": "~/.claude/hooks/check-bash.sh", "onFailure": "block"}]}]}}

hooks.json or inline [hooks] next to any config layer (e.g. ~/.codex/hooks.json, <repo>/.codex/hooks.json, requirements.toml). [[hooks.PreToolUse]] matcher = "^Bash$"; [[hooks.PreToolUse.hooks]] type = "command", command = "/abs/policy.py", timeout = 30. Blocking events: PreToolUse (Bash/unified exec, apply_patch alias Edit|Write, MCP tools, other local function tools); PermissionRequest (allow/deny an approval; any deny wins); UserPromptSubmit; PostToolUse block only feeds back after the fact; Stop/SubagentStop block means continue. Input: JSON on stdin with session_id, transcript_path, cwd, hook_event_name, model, permission_mode, turn_id, tool_name, tool_use_id, tool_input. Block: exit 2 with a reason on stderr, or {"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"..."}} (legacy {"decision":"block"}). Can rewrite input with permissionDecision allow + updatedInput. Handlers: command and mcp_tool.

settings hooks.BeforeTool: [{"matcher":"run_shell_command|write_file","hooks":[{"type":"command","command":"$GEMINI_PROJECT_DIR/.gemini/hooks/check.sh","timeout":5000}]}]. stdin JSON: session_id, transcript_path, cwd, hook_event_name, timestamp, tool_name, tool_input, mcp_context, original_request_name. Block by printing {"decision":"deny","reason":"..."} (exit 0) or exiting 2 (stderr becomes the reason); {"decision":"ask"} forces a prompt; {"continue":false} stops the agent; hookSpecificOutput.tool_input rewrites args. Other blocking events: BeforeAgent, BeforeModel, AfterModel, AfterTool (hide result), BeforeToolSelection (filter tools). Toggles: hooksConfig.enabled, hooksConfig.disabled.

Plugins, not config hooks. Put a JS/TS module in .opencode/plugins/ or ~/.config/opencode/plugins/, or list npm packages in plugin. Hook tool.execute.before(input {tool, sessionID, callID}, output {args}) runs before the tool and its permission check; throwing an Error blocks the call, and mutating output.args rewrites it. Example: export const P = async () => ({ "tool.execute.before": async (i, o) => { if (i.tool === "bash" && /rm -rf/.test(o.args.command)) throw new Error("blocked") } }). Other hooks: tool.execute.after, shell.env, chat.params, event (sees permission.asked / permission.replied).

Events that can block

preToolUse (allow/deny, can rewrite input via updated_input), beforeShellExecution and beforeMCPExecution (allow/deny/ask), beforeReadFile (allow/deny; receives full file content), beforeTabFileRead, subagentStart (allow/deny), beforeSubmitPrompt. stop and subagentStop can force follow-ups.

Input

JSON on stdin. Common fields: conversation_id, generation_id, model, hook_event_name, cursor_version, workspace_roots, user_email, transcript_path. Event fields, e.g. beforeShellExecution {command, cwd, sandbox}.

Blocking

Exit 2 or stdout {"permission":"deny"}. For permission hooks, invalid JSON blocks. Other failures fail open unless "failClosed": true. Types: command or prompt (LLM-evaluated). The matcher is a regex.

Config

{"version":1,"hooks":{"beforeShellExecution":[{"command":".cursor/hooks/guard.sh","matcher":"curl|wget","failClosed":true}]}}. Locations: enterprise MDM paths, team (Enterprise dashboard, synced every 30 min), project .cursor/hooks.json, user ~/.cursor/hooks.json, plus Claude Code settings.json hooks.

Cli and cloud agent

Events: preToolUse (allow / deny / ask, modifiedArgs), permissionRequest (CLI only; allow/deny short-circuits the permission service; cannot pre-approve sandbox bypass), agentStop / subagentStop (block = continue), userPromptSubmitted, sessionStart, postToolUse and more. Input: JSON on stdin, camelCase {sessionId, timestamp, cwd, toolName, toolArgs} or the VS Code-compatible PascalCase snake_case form. Types: command, http, prompt. A preToolUse command hook fails closed on crash or non-zero exit (exit 2 = deny), but timeouts fail open. Config: {"version":1,"hooks":{"preToolUse":[{"type":"command","bash":"./guard.sh"}]}}.

Cli locations

Policy hooks /etc/github-copilot/policy.d/*.json, C:\ProgramData\GitHub\Copilot\policy.d\*.json, or the HKLM registry (root-owned; cannot be disabled; run outside the sandbox). Repo .github/hooks/*.json. ~/.copilot/hooks/*.json. Inline 'hooks' in .github/copilot/settings(.local).json, .claude/settings(.local).json and ~/.copilot/settings.json. Plugins. Agent frontmatter.

Cloud agent locations

.github/hooks/*.json from the default branch only. bash entries only. 'ask' is treated as deny.

VS Code

Local harness (Preview): PreToolUse permissionDecision allow/deny/ask, exit 2 blocks. Files: .github/hooks/*.json, ~/.copilot/hooks/*.json, .claude/settings.json (needs chat.useClaudeHooks), agent frontmatter, plugins. Agent Host Copilot sessions use the CLI hook implementation. Policies: ChatHooks (Local), ChatAllowManagedHooksOnly.

Cascade events

Pre-hooks that can block: pre_user_prompt, pre_read_code, pre_write_code (input includes edits), pre_run_command (command_line, cwd), pre_mcp_tool_use (server, tool, arguments). Post-hooks: post_read_code, post_write_code, post_run_command, post_mcp_tool_use, post_cascade_response, post_cascade_response_with_transcript, post_setup_worktree.

Input

JSON on stdin: agent_action_name, trajectory_id, execution_id, timestamp, model_name, tool_info.

Blocking

Exit code 2 blocks (stderr is shown to the agent). Any other non-zero exit lets the action proceed.

Config

{"hooks":{"pre_run_command":[{"command":"python3 /usr/local/share/hooks/guard.py","show_output":true}]}}. Locations, merged and run in order: cloud dashboard 'Agent hooks' (Enterprise), system (/Library/Application Support/Devin/hooks.json, /etc/devin/hooks.json, C:\ProgramData\Devin\hooks.json, with legacy Windsurf fallback), user ~/.codeium/windsurf/hooks.json, workspace .devin/hooks.json (legacy .windsurf/hooks.json).

Devin local

Separate lifecycle hooks format, e.g. the 'hooks' key in .devin/config.json.

Managed settings (same JSON shape as settings.json) via server-managed settings (claude.ai admin console or Claude apps gateway), MDM (macOS com.anthropic.claudecode profile, Windows HKLM\SOFTWARE\Policies\ClaudeCode), or files: /Library/Application Support/ClaudeCode/managed-settings.json, /etc/claude-code/managed-settings.json, C:\Program Files\ClaudeCode\managed-settings.json (+ managed-settings.d/*.json, managed-mcp.json). Managed-only keys include allowManagedPermissionRulesOnly, allowManagedHooksOnly, allowManagedMcpServersOnly, managedMcpServers, sandbox.network.allowManagedDomainsOnly, sandbox.filesystem.allowManagedReadPathsOnly, strictKnownMarketplaces, blockedMarketplaces, strictPluginOnlyCustomization, disableSideloadFlags, forceRemoteSettingsRefresh, disableCommandPluginSources, policyHelper, managedSourcesBehavior. Any key can be set in managed settings and then cannot be overridden. Example: {"permissions": {"deny": ["Read(./.env)"], "disableBypassPermissionsMode": "disable"}, "allowManagedPermissionRulesOnly": true}

Enforced requirements (requirements.toml schema) at /etc/codex/requirements.toml, %ProgramData%\OpenAI\Codex\requirements.toml, macOS MDM com.openai.codex requirements_toml_base64, cloud-managed Agent Security bundle, legacy /etc/codex/managed_config.toml. Keys: allowed_approval_policies, allowed_approvals_reviewers, allowed_sandbox_modes, allowed_permission_profiles, default_permissions, [permissions.<name>], permissions.filesystem.deny_read, allowed_web_search_modes, [experimental_network], [rules] prefix_rules (prompt/forbidden), [hooks] + managed_dir + allow_managed_hooks_only, [mcp_servers.<id>].identity, plugins.<plugin>.mcp_servers, [apps], [features] pins, guardian_policy_config / auto_review, allowed_login_methods, allowed_chatgpt_workspaces, cli_auth_credentials_store, model_provider(s), enforce_residency, log_dir, sqlite_home, allow_login_shell, browser_use / computer_use / in_app_browser policies, windows.* sandbox implementation. Defaults-only: managed_config.toml, MDM config_toml_base64, cloud config.toml, /etc/codex/config.toml.

(1) System overrides settings.json (merged last), e.g. {"security":{"disableYoloMode":true},"mcp":{"allowed":["corp"]},"tools":{"sandbox":"docker"}}. (2) Admin-tier policy TOMLs in the system policies dir (tier 5, beats user and project). (3) Remote enterprise admin controls (Strict Mode, extensions on/off, MCP on/off, MCP allowlist and required servers, unmanaged capabilities/skills), which cannot be set by local files. (4) security.auth.enforcedType.

Managed files (/Library/Application Support/opencode/, /etc/opencode/, %ProgramData%\opencode) and macOS MDM plist domain ai.opencode.managed are merged after the user and project layers. Example managed opencode.json: {"share":"disabled","permission":{"bash":{"rm -rf *":"deny"}},"mcp":{"x":{"enabled":false}}}. experimental.policies (provider.use only) gives global precedence over project.

Team dashboard

Run Mode / Auto Run Configuration, command allow and deny lists, sandbox networking, Read Controls, MCP Configuration, Cursor Ignore Configuration, .cursor Directory Protection, Browser Controls, team hooks, model access, Privacy Mode, repository blocklist. Team settings beat individual and project config.

Mdm

Windows Group Policy, macOS profiles, Linux JSON: AllowedExtensions, AllowedTeamId, ExtensionGalleryServiceUrl, NetworkDisableHttp2, UpdateMode, WorkspaceTrustEnabled. Plus the system hooks.json path.

File distribution

~/.cursor/permissions.json can be pushed by MDM, but it is a normal user file.

Copilot managed settings

Keys: permissions.disableBypassPermissionsMode / deny / ask / allow (+ limitTo in CLI), sandbox, allowedMcpServers, deniedMcpServers, enabledPlugins, extraKnownMarketplaces, strictKnownMarketplaces, telemetry, remoteControl, model, autoTier, features.computerUse; CLI-only extras such as forceLoginOrgs and shellShortcut. Most managed keys lock the whole row.

Vscode device policies

Chat* / Copilot* policies override user settings (see config_scopes).

Github policies

Client enablement (Copilot CLI), cloud agent enablement or blocking, MCP policy, models, content exclusion, cloud agent firewall (org-locked).

Team settings

Maximum autonomy level, legacy command lists, Devin CLI permissions (allow/ask/deny, highest precedence), Devin Sandbox, Sandbox domains, Sandbox command exclusions, Web search, Allow MCP, MCP allowlist, MCP registry and enforcement, Agent hooks, Enable Cascade, Restrict Cascade to workspace, model allowlist, extension policy, marketplace URL, sharing. 'Users can override? No'.

Device policies

AllowedExtensions, ExtensionGalleryServiceUrl, ExtensionsAutoUpdate(Delay), UpdateMode, TelemetryLevel, EnableFeedback.

System files

hooks.json, rules, workflows, skills, system.json in the system directory.

Interactive sessions show a workspace trust dialog the first time Claude Code starts in an untrusted folder (keyed on the git repository root; stored as projects["<path>"].hasTrustDialogAccepted in ~/.claude.json; never persisted when started in the home directory). The dialog lists the allow rules and additional directories the folder would grant. deny and ask rules apply immediately. permissions.allow, additionalDirectories, most env values, hooks/helper commands and extraKnownMarketplaces wait for trust. Project .mcp.json servers additionally need per-server approval, and a repo cannot self-approve them while untrusted. claude -p and Agent SDK sessions never show the dialog.

Project .codex layers (config.toml, hooks, .rules, plus project AGENTS.md since 0.150.0) load only when projects."<repo-root>".trust_level = "trusted" is in the user config (or a managed layer). Unknown and untrusted projects get the layer loaded but disabled. The interactive TUI shows a trust prompt for an undecided project before starting: 'Trust this folder? ... Folder settings can run code automatically, even without a model request.' Options: 'Trust and continue' (pre-selected) or 'Quit'. The choice is written to ~/.codex/config.toml. A subdirectory of a git repo trusts the repo root. An explicitly untrusted folder opens 'restricted'.

Folder trust (security.folderTrust.enabled, default true in v0.63.0). The first run in an unknown folder shows a trust dialog listing the repo's commands, MCP servers, hooks, skills, agents and setting keys, with warnings for tools.allowed, folderTrust.enabled=false and tools.sandbox=false. Until trusted, .gemini/settings.json, project .env (except whitelisted auth vars), MCP servers, hooks, custom commands and extension management are off, and approval is forced to default. Headless runs in an untrusted folder exit (FatalUntrustedWorkspaceError) unless --skip-trust or GEMINI_CLI_TRUST_WORKSPACE=true. Decisions are stored in ~/.gemini/trustedFolders.json.

There is no trust prompt. On startup OpenCode merges opencode.json(c) from the cwd up to the git root and every .opencode/ dir, with project config above global config. It auto-loads project agents, commands, modes, plugins, custom tools and skills. It runs a background npm install (scripts ignored) of the project .opencode/package.json deps, and starts project-defined MCP servers. Opt-outs are user-side only: OPENCODE_DISABLE_PROJECT_CONFIG=1 (source), --pure (plugins).

Trust prompt

The IDE supports VS Code Workspace Trust, but it is disabled by default. With it disabled, all workspaces are treated as trusted. Enable it with "security.workspace.trust.enabled": true, or enforce it with the WorkspaceTrustEnabled MDM policy. Restricted mode 'breaks AI features'. The CLI shows a workspace-trust prompt in interactive mode. Headless runs fail in untrusted workspaces unless --trust or --force is passed.

Applied automatically from a cloned repo

• .cursor/permissions.json: terminalAllowlist, mcpAllowlist and autoRun (allow_instructions) are concatenated with the user's file. A repo can pre-approve commands or all MCP tools ('*:*').
• .cursor/sandbox.json: per-repo has priority over per-user. Paths and network allow lists are unioned, so a repo can widen network egress and writable paths for sandboxed commands.
• .cursor/hooks.json: arbitrary commands run on agent events in 'trusted' workspaces, which is all of them by default.
• .claude/settings.json and .claude/settings.local.json: Claude Code hooks, loaded by default via Third-Party Imports.
• .cursor/mcp.json: servers are listed but need approval.
• .cursor/rules/, AGENTS.md: prompt context only.
• .cursor/worktrees.json setup commands: gated by workspace trust (CLI).
• CLI .cursor/cli.json: project-level permissions.allow and deny.

Can repo enable run everything

No documented repo-level key sets Run Mode, so not documented as possible. The repo can still weaken safety: expand allowlists, steer the classifier, widen the sandbox, and run hooks. Team admin controls override permissions.json allowlists. Hardcoded rules stop the agent from writing .cursor/*.json from inside the sandbox.

VS Code

Workspace Trust is on by default (security.workspace.trust.enabled = true). Restricted Mode disables agents, workspace settings and terminals. Once trusted: 'restricted' workspace settings in .vscode/settings.json are honoured (chat.tools.terminal.autoApprove, chat.tools.terminal.ignoreDefaultAutoApproveRules, sandbox settings). Servers in .vscode/mcp.json and .mcp.json start with no separate MCP trust prompt. .github/hooks/*.json run. package.json scripts are auto-approved by default. chat.tools.global.autoApprove cannot come from the workspace.

CLI

On first launch in a directory, the CLI asks whether to trust its files: Yes / Yes and remember / No (ends the session). After trust: .mcp.json and .github/mcp.json servers load. .github/hooks/*.json and hooks in .github/copilot/settings.json and .claude/settings.json run. Repo settings may set enabledPlugins + extraKnownMarketplaces (auto-installs repo-scoped plugins, which bring hooks, MCP servers and agents), extend deny lists (union only), set disableAllHooks, and pin model/effort (trusted only). Repo settings cannot add allow rules or turn on allow-all. In -p mode, repo hooks and workspace MCP need an already-trusted folder or the env opt-ins.

Cloud agent

No trust prompt. The repo is the trust boundary and only users with write access can trigger the agent. Repo files apply automatically: .github/hooks/*.json and copilot-setup-steps.yml (both from the default branch), custom agents, and the plugin keys of .github/copilot/settings.json. Firewall and MCP configuration live in repo or org settings, not files.

Trust prompt

Devin Desktop (a VS Code fork) has Restricted Mode. Since v3.6.21/3.6.22 (July 29, 2026), Cascade, Devin Local, ACP agents and hooks are all disabled while a workspace is in Restricted Mode. Since v3.8.20 the UI warns about untrusted workspaces and offers a 'trust workspace' prompt. Whether Workspace Trust is enabled by default (a prompt on folder open) is not documented.

Applied once trusted

• .devin/hooks.json or .windsurf/hooks.json: arbitrary shell commands on Cascade actions, e.g. on the first prompt via pre_user_prompt.
• .devin/rules, .devin/workflows, skills, AGENTS.md: prompt context.
• .devinignore: narrows only.
• Cascade MCP: user-level file only, so a repo cannot add Cascade MCP servers.
• Devin Local: .devin/config.json permissions (project outranks user, so a repo can add allow rules), hooks and MCP servers. The shared Devin CLI harness also imports MCP servers from .cursor/mcp.json, .mcp.json, .claude/settings.json, opencode.json and .zed/settings.json.

Can repo set turbo

Unknown for Cascade (storage of the auto-execution level is undocumented). Devin Local: no documented repo key for Bypass mode, but repo allow rules have the same effect for the commands they match. Org deny/ask rules still win.

Local: full plaintext transcripts at ~/.claude/projects/<project>/<session>.jsonl (every message, tool call and tool result; subagent transcripts under <session>/subagents/), prompt history in ~/.claude/history.jsonl, file snapshots in ~/.claude/file-history/, debug logs with --debug or --debug-file. Retention: cleanupPeriodDays (default 30, minimum 1). Structured audit: OpenTelemetry events (opt-in, exported to a collector, not written locally): claude_code.tool_decision (decision accept/reject, source config/hook/user_permanent/user_temporary/user_abort/user_reject), permission_mode_changed, hook_execution_complete, mcp_server_connection, tool_result, managed_settings_resolved. Example managed env: {"env": {"CLAUDE_CODE_ENABLE_TELEMETRY": "1", "OTEL_LOGS_EXPORTER": "otlp", "OTEL_EXPORTER_OTLP_ENDPOINT": "http://collector:4317", "OTEL_LOG_TOOL_DETAILS": "1"}}

Session rollouts: $CODEX_HOME/sessions/YYYY/MM/DD/rollout-<timestamp>-<thread-id>.jsonl (archived under archived_sessions/) persist messages, tool/function calls and their outputs, web search calls and config updates. Prompt history: ~/.codex/history.jsonl ({session_id, ts, text}); history.persistence = "save-all" | "none", history.max_bytes. Optional log_dir enables codex-tui.log. OpenTelemetry (off by default): [otel] exporter = otlp-http|otlp-grpc, emits codex.tool_decision (approved/denied, source config vs user), codex.tool_result, codex.user_prompt (redacted unless log_user_prompt = true). codex exec --ephemeral writes no session files.

Always on: session transcripts with every tool call's inputs and outputs in ~/.gemini/tmp/<project_hash>/chats/ (auto-deleted after 30 days by default via general.sessionRetention.maxAge) and a prompt log logs.json. Opt-in OpenTelemetry: telemetry.enabled=true with target local|gcp, outfile or otlpEndpoint; the gemini_cli.tool_call event records function_name, function_args and decision (accept|reject|auto_accept|modify). Hooks (AfterTool, BeforeTool) can also log.

Each permission evaluation (evaluated, with permission, pattern and action) and each prompt (asking) is logged at INFO, the default level, to ~/.local/share/opencode/log/<timestamp>.log. Sessions, messages and tool calls are stored in the SQLite DB ~/.local/share/opencode/opencode.db (opencode db path, opencode export <sessionID>). Plugins can subscribe to permission.asked / permission.replied events.

Admin audit log

Enterprise audit log (dashboard, Admin API GET /teams/audit-logs, SIEM/webhook/S3 streaming). Records admin and security events such as team_settings changes (old/new value), team_hook changes (including script content), and mcp_server_config. It does not record prompts, agent output, or agent tool calls.

Telemetry

OpenTelemetry Export (Enterprise): cursor.tool.calls metric (builtin vs MCP counts) and cursor.hook.execution_complete logs. Conversation content and tool I/O cover Cloud Agents and Grok Bot only, not the IDE or CLI.

Local

Hooks are the documented way to log tool calls and decisions (postToolUseFailure reports failure_type 'permission_denied'). Transcripts are written to transcript_path. A Hooks output channel exists in the IDE.

Github audit log

Enterprise audit log: Copilot policy and settings changes, and agent activity on github.com (filter actor:Copilot; fields actor_is_agent, agent_session_id). Retained 180 days; streamable to a SIEM. Preview: streamed Copilot API usage records with request/response bodies (EMU and data residency enterprises).

Client

Local client sessions are not in the audit log. Use hooks or OpenTelemetry. CLI: OTel execute_tool spans (arguments and results only with content capture). Since 1.0.96 the timeline shows who made each permission decision (you, Assisted Permissions, policy, unattended fallback). VS Code: CopilotOtel* policies, auto-approval notifications.

Cloud agent

Session logs, signed commits with a link to session logs, audit log events.

Analytics

Analytics API data sources: cascade_tool_usage (per-tool call counts such as RUN_COMMAND and MCP tool) and cascade_runs. These cover Devin Local and Devin CLI activity recorded after those agents started reporting. Individual-level analytics is an admin toggle.

Hooks

post_run_command, post_mcp_tool_use and post_cascade_response_with_transcript are the documented way to build an audit trail.

Admin audit log

No admin audit log of agent tool calls or permission decisions is documented.