Permissions
Control what agents can do without asking: what needs permission, answering approval cards, Allow/Ask/Deny rules, folder trust, the browser, the sandbox, and hooks.
Agents can read your project, edit your documents, and run commands. Permissions decide which of those actions happen straight away and which wait for your yes. You control them in three ways: a permission mode for each chat, rules for specific actions, and trust for each project folder.
What asks for permission
In Autopilot, the mode new installs start in, routine work runs straight through and these still ask first:
| Action | Example |
|---|---|
| Shell commands | Running a script to process your data |
| Installs | Installing a package a script needs |
| Deletions | Removing a file from the project |
| Protected files | Changing the assistant’s own setup files |
| Anything outside the project | Reading or writing a file in another folder |
| A new website in the built-in browser | Opening and acting on a site for the first time in a chat |
In Approve mode you approve the agent’s actions as it goes. See permission modes for what each mode lets through.
What always asks
- Deleting files. Commands that delete files always ask, and there is no “always allow” for them.
- Changes to the assistant’s setup — its agents, skills, instructions, and hooks, plus
AGENTS.mdand your.gitfolder — always ask unless Bypass permissions is on. - In plan mode, only read-only commands run without asking; any other command asks first, in every mode.
Answer a permission request
When an agent needs your permission, it shows an approval card in the chat:
- Code is shown first. If the agent wants to run code, the card shows it before you approve.
- Approve to let this one action go ahead.
- Always allow remembers the specific command it was given for, and shows that command on the button, so you know exactly what you’re allowing from now on.
- Deny to stop it.
Read before you allow
Approving is quick, so it’s easy to click through. Glance at what the card says will happen — especially for commands that change or remove files.Manage permission rules
Type /permissions in chat to see every permission rule in one place. Rules come in three kinds:
| Rule | What it does |
|---|---|
| Allow | The action runs without asking. |
| Ask | The agent asks you every time. |
| Deny | The action never runs. |
Rules can be set for you (every project), this project, or your organization. Choosing Always allow on an approval card remembers that command, so it doesn’t ask again.
Which rule wins
A Deny anywhere wins. If any rule — yours, the project’s, or your organization’s — denies an action, it doesn’t run, whatever the other rules or the chat’s mode say.
Trust a project folder
A project you open from somewhere else — downloaded, shared, or cloned — starts in Restricted Mode. Until you trust it, these stay off:
- the terminal;
- version tracking;
- Git hooks;
- the project’s own MCP servers and hooks.
Look before you trust
Check where the project came from, and read itsAGENTS.mdand any hooks.Trust it
Choose Trust This Folder. The features above turn on.
Projects Multilo creates for you are trusted automatically, and stay trusted if you rename them.
Permissions in the built-in browser
With Web on in a chat, the agent can use the built-in browser to open, read, and click through pages. The first time it acts on a site in a chat, it asks: Allow for this chat, Always allow that site, or deny. Pages served from your own computer (localhost) don’t ask. The agent is told not to enter passwords or payment details, solve CAPTCHAs, make purchases, create accounts, or take irreversible actions without your approval.
Run commands in a sandbox
On macOS, /sandbox lets the agent’s shell commands run without asking, because inside the sandbox they can only change files in the project and reach websites you’ve allowed. It’s off by default. Use it for long data-processing runs where approving every command would slow you down.
Extend permissions with hooks
/hooks runs your own commands at set points in a task — for example, to run a check after the agent edits a file. Hooks use the same format as Claude Code. A project’s hooks run only in a trusted folder, after you’ve reviewed them.
Extensions and skills
Extensions declare the permissions they need, and you see them before an extension runs. Skills can list the tools they may use and are held to that list. Official extensions and skills carry Multilo’s signature. See security.
Rules for an organization
Organizations can set permission rules for everyone through Windows and macOS device management. Those rules appear in /permissions with your own, and an organization’s Deny still wins.