Manage approvals and permissions

Agents in Visual Studio Code can edit files, run terminal commands, and call external tools. VS Code uses two security layers to help you control these actions:

• Approvals determine whether an action runs automatically or requires your confirmation.
• Sandboxing restricts the file system and network resources that agent terminal commands can access, even after the commands are approved.

This article explains how these layers work together and how to configure permission levels, tool and URL approvals, terminal auto-approval, and sandboxing. For the security concepts behind these controls, see Trust and safety.

Permission levels

Permission levels control how the agent handles approvals for the current chat session. Select a level from the permissions dropdown in the chat input. You can change it at any time.

The levels below describe Copilot harness sessions. For other harnesses, see Claude permission modes and Codex approval presets.

New sessions use the level configured by chat.permissions.default Open in VS Code Open in VS Code Insiders . An organization can set a different managed default for Copilot harness sessions. The managed default doesn't prevent you from switching to another level that the organization allows.

To use Assisted permissions, choose Folder isolation. Worktree sessions always use Allow all.

Enable the chat.assistedPermissions.enabled Open in VS Code Open in VS Code Insiders setting, and then select Assisted permissions from the permissions picker. This option isn't available for Local harness sessions.

An organization can use enterprise-managed settings to control permission levels. These settings can hide Assisted permissions or Allow all from the permissions picker.

Sandboxing is independent of the permission level. Allow all and Autopilot skip approval prompts, but an enabled sandbox still restricts terminal file system and network access. The sandbox doesn't cover every tool, so use tool and URL approvals to control other actions with Manual permissions.

How Autopilot works

Autopilot is an agent mode, not a permission level. Select it from the mode picker in the chat input to let the agent work autonomously until it determines that the task is complete. Autopilot:

• Auto-approves all tools, like Allow all.
• Retries when it encounters errors.
• Responds automatically to questions that would otherwise block progress.

Advanced autopilot (Preview)

Advanced Autopilot delegates the completion decision to a separate model. After each turn, a small, fast model evaluates whether the original request is complete and guides the next turn when more work is needed. Set chat.autopilot.advanced.enabled Open in VS Code Open in VS Code Insiders to true to use this preview feature.

Claude permission modes

Claude harness sessions support these permission modes:

• Edit automatically: apply changes without asking for approval.
• Request approval: ask before applying changes.
• Plan: outline the approach before implementation.

Codex approval presets

The direct Codex integration provides these approval presets. For the extension-based integration, use the OpenAI Codex extension's documentation.

• Default Permissions: read and edit workspace files and run routine local commands. Codex asks before using the internet or accessing resources outside the workspace.
• Auto-Review: use the same workspace access as Default Permissions, but send approval requests to an automatic reviewer instead of prompting you.
• Full Access: edit files outside the workspace and use the internet without asking.

Allow all tools globally

To auto-approve tools across all workspaces, enable chat.tools.global.autoApprove Open in VS Code Open in VS Code Insiders . To bypass approvals only for the current supported local or Copilot CLI session, use /yolo or /autoApprove. Use /disableYolo or /disableAutoApprove to restore the session's default permission level.

Prefer the session-scoped Allow all level when you do not need auto-approval in every workspace.

Tool approval

Some tools can modify your environment or access external services. Their results can also contain prompt injection attempts. Tool approval protects against both risks.

When approval is required, review the tool name and input parameters, then approve a single use or grant approval for the session, workspace, or all future invocations.

For files that contain secrets or sensitive configuration, require explicit approval for edits to sensitive files.

Manage tool approvals

Run Chat: Manage Tool Approval from the Command Palette (⇧⌘P (Windows, Linux Ctrl+Shift+P)) to review and configure approvals. Tools are grouped by source, such as an MCP server or extension.

Expand a source to configure approvals for individual tools, or select the top-level checkboxes to trust all tools from a specific MCP server or extension at once.

Prevent tools from being auto-approved

Set a tool to false in chat.tools.eligibleForAutoApproval Open in VS Code Open in VS Code Insiders to always require manual approval. The confirmation dialog then does not offer an auto-approval option for that tool.

Organizations can also use device management policies to enforce manual approvals for specific tools. Learn more in the Enterprise documentation.

Reset tool confirmations

Run Chat: Reset Tool Confirmations from the Command Palette (⇧⌘P (Windows, Linux Ctrl+Shift+P)) to clear all saved approvals. To change individual approvals, use Chat: Manage Tool Approval.

URL approval

When a tool accesses a URL, such as the #web/fetch tool, VS Code separates approval into two decisions:

For each step, you can approve once or automatically approve future requests or responses for the URL or domain. Approving a request does not approve its response.

Request approval uses the Trusted Domains list. A trusted domain does not require request approval, but its response still requires review unless you separately auto-approve responses for that domain.

Use chat.tools.urls.autoApprove Open in VS Code Open in VS Code Insiders to store exact URLs, glob patterns, or wildcards. Set a pattern to a boolean to control both steps, or use approveRequest and approveResponse to control them separately.

URL auto-approval examples:

{
  "chat.tools.urls.autoApprove": {
    "https://www.example.com": false,
    "https://*.contoso.com/*": true,
    "https://example.com/api/*": {
      "approveRequest": true,
      "approveResponse": false
    }
  }
}

Automatically approve terminal commands

The agent uses one tool to run any terminal command. To avoid granting that tool unrestricted approval, VS Code evaluates each command separately.

By default, common read-only commands run automatically, while risky commands such as rm and del require approval. Add rules to chat.tools.terminal.autoApprove Open in VS Code Open in VS Code Insiders to change this behavior:

• Set a command to true to auto-approve it.
• Set a command to false to require approval.
• Wrap a regular expression in / characters to match a command pattern.

For example:

{
  // Allow the `mkdir` command
  "mkdir": true,
  // Allow `git status` and commands starting with `git show`
  "/^git (status|show\\b.*)$/": true,

  // Always require approval for the `del` command
  "del": false,
  // Always require approval for commands containing "dangerous"
  "/dangerous/": false
}

A false rule requires approval. It does not block the command. To block a terminal tool call in the Local harness, use a Preview PreToolUse hook that returns permissionDecision: "deny".

By default, rules match each subcommand. A compound command is auto-approved only when all its subcommands match a true rule and none match a false rule. A false rule always takes precedence.

To evaluate the full command line instead, use object syntax and set matchCommandLine to true.

Related settings:

• Disable chat.tools.terminal.enableAutoApprove Open in VS Code Open in VS Code Insiders to require approval for every command.
• chat.tools.terminal.blockDetectedFileWrites Open in VS Code Open in VS Code Insiders Block detected terminal file writes is experimental and might change or be removed. defaults to outsideWorkspace, which requires approval for detected writes outside the workspace. The OS temporary folder (/tmp on macOS and Linux, %TEMP% on Windows) is exempt when session-level command approval is active.
• Enable the experimental chat.tools.terminal.ignoreDefaultAutoApproveRules Open in VS Code Open in VS Code Insiders setting to ignore the built-in rules and use only your rules. Built-in deny rules are designed to protect against dangerous commands.

Sandbox agent commands

Agent sandboxing restricts file system and network access for terminal commands. It is independent of the selected permission level, so an enabled sandbox continues to restrict terminal commands with Allow all and Autopilot.

In a Copilot harness session, select Sandboxing for terminal in the permissions picker to turn sandboxing on or off for that session. New sessions use the effective sandbox configuration on the machine where commands run, and an explicit session selection persists when you restore the session. Managed settings can require sandboxing and disable the toggle.

Restart VS Code after you change chat.agent.networkFilter Open in VS Code Open in VS Code Insiders , chat.agent.allowedNetworkDomains Open in VS Code Open in VS Code Insiders , or chat.agent.deniedNetworkDomains Open in VS Code Open in VS Code Insiders to ensure new integrated browser sessions use the updated network policy.

Learn how to configure agent terminal sandboxing, including platform prerequisites, file system and network restrictions, session behavior, and fallback controls.

Related resources

• Use tools with agents
• Security considerations for using AI in VS Code
• Trust and safety concepts