AI Systems Atlas

S-17Allow, Ask, Deny: Permission Policies

/security/permissions

Per-tool allow, ask and deny rules, scoped by argument, decide each proposed call before it runs; a permission mode sets the default for everything the rules don’t mention.

Step-by-step walkthrough8 steps
  1. The agent proposes a tool call. Nothing runs until a check outside the model answers.
  2. npm test matches an allow rule, so it runs with no prompt — the common case stays fast.
  3. git push matches an ask rule. The same tool, a riskier argument: a person decides.
  4. Approved once — and the approval covers exactly that command, not the whole shell.
  5. Reading a private key matches a deny rule. Deny is checked first; no allow rule can carve an exception.
  6. A call no rule mentions falls through to the session’s permission mode.
  7. Modes run from read-only to autonomous: each step right auto-approves more of what is left unmatched.
  8. Explicit deny rules hold in every mode — autonomy widens the defaults, never the hard limits.
Key insight

Scope rules by argument, not by tool: the same shell that runs the tests can push to main or read a private key. Evaluate deny before allow so a broad block can never be undone by a narrow exception.

Failure mode

Rules so coarse that every call asks. People approve on reflex, then widen the mode to make the prompts stop, and the only rule left standing is “allow everything”.

Further reading
RelatedGuardrail middlewareHuman-in-the-loopPrivilege escalationAudit logs

Elsewhere in the atlas

Harnesses →Evals →Context →Coding Agents →Tools →Ops →