Three permission modes#

Mode	Suitable stage	Tool behavior
Explore	Research and planning	Read-only exploration within allowed rules; writes and commands are restricted
Ask / Ask to Edit	Changes requiring review	Requests approval according to permission rules
Execute	Implementation with a clear scope	Runs within authorized scope, usually without per-action prompts

Plan, review, then execute#

Request a plan and explicitly ask the agent to wait for approval.
Check sources, output folders, affected files and external actions.
Request revisions if needed; otherwise select Approve and Execute (批准并执行).
Inspect progress and open the deliverables when complete. A plan is a workflow, not a fourth permission mode. Approving it does not professionally validate the conclusions.

Review a tool approval#

Check the actual target, path and write or sending scope. Existing rules can reduce prompts; do not assume every external action will ask again. Execute mode remains constrained by account, server and operating-system permissions.

Does Stop undo work?#

No. Completed writes or external actions are not automatically reversed. Stop promptly if needed, then inspect what already happened. A remote approval must refer to the same computer, workspace and conversation, with the target online.

Scope of remembered approvals#

From RC44, file writes can be remembered for an explicit directory. Ambiguous relative paths do not offer Always Allow. Compound commands offer one-time Allow or Deny; arguments and network targets affect approval scope. Child tasks are capped by parent permissions, and activating a source does not bypass tool approval.