> AI agents: For documentation discovery and navigation, see [llms.txt](/llms.txt).

# Manage approvals and permissions

Agents in Visual Studio Code can edit files, run terminal commands, and call external tools. VS Code uses two security layers to help you control these actions:

* **Approvals** determine whether an action runs automatically or requires your confirmation.
* **Sandboxing** restricts the file system and network resources that agent terminal commands can access, even after the commands are approved.

This article explains how these layers work together and how to configure permission levels, tool and URL approvals, terminal auto-approval, and sandboxing. For the security concepts behind these controls, see [Trust and safety](/docs/agents/concepts/trust-and-safety.md).

<div class="docs-action" data-show-in-doc="false" data-show-in-sidebar="true" title="Trust and safety concepts">
Learn why VS Code uses permission levels, tool approval, and sandboxing to keep you in control.

* [Read about trust and safety](/docs/agents/concepts/trust-and-safety.md)

</div>

| Mechanism | What it controls | Key setting |
|---|---|---|
| [Permission levels](#permission-levels) | The approval behavior for a chat session | `setting(chat.permissions.default)` |
| [Tool approval](#tool-approval) | Which tools require confirmation before or after they run | `setting(chat.tools.eligibleForAutoApproval)` |
| [URL approval](#url-approval) | Which URLs can be requested and which responses can enter the chat context | `setting(chat.tools.urls.autoApprove)` |
| [Terminal approval](#automatically-approve-terminal-commands) | Which terminal commands run without confirmation | `setting(chat.tools.terminal.autoApprove)` |
| [Sandboxing](/docs/agents/run/agent-sandboxing.md) | The file system and network boundaries for terminal commands | `setting(chat.agent.sandbox.enabled)` |

## Permission levels

Permission levels control how the agent handles approvals for the current chat session. Select a level from the permissions dropdown in the chat input. You can change it at any time.

The levels below describe Copilot harness sessions. For other harnesses, see [Claude permission modes](#claude-permission-modes) and [Codex approval presets](#codex-approval-presets).

New sessions use the level configured by `setting(chat.permissions.default)`. An organization can set a different managed default for Copilot harness sessions. The managed default doesn't prevent you from switching to another level that the organization allows.

To use **Assisted permissions**, choose **Folder** isolation. Worktree sessions always use **Allow all**.

`feature(assisted-permissions)`

Enable the `setting(chat.assistedPermissions.enabled)` setting, and then select **Assisted permissions** from the permissions picker. This option isn't available for Local harness sessions.

| Permission level | Description |
|---|---|
| **Manual permissions** (default) | Uses your tool, URL, and terminal approval settings. Actions that are not auto-approved require your confirmation. |
| **Assisted permissions** | Uses an LLM judge to assess each tool call. Calls that the judge does not approve require your confirmation. |
| **Allow all** | Runs all tool calls without confirmation. |

An organization can use [enterprise-managed settings to control permission levels](/docs/enterprise/manage-ai-settings.md#manage-permission-levels). These settings can hide **Assisted permissions** or **Allow all** from the permissions picker.

Sandboxing is independent of the permission level. **Allow all** and **Autopilot** skip approval prompts, but an enabled sandbox still restricts terminal file system and network access. The sandbox doesn't cover every tool, so use tool and URL approvals to control other actions with **Manual permissions**.

> [!IMPORTANT]
> **Assisted permissions** reduces approval interruptions but does not replace your judgment. The model-based risk assessment can make mistakes. The first time you select this level, a warning dialog asks you to confirm.

> [!CAUTION]
> **Allow all** and **Autopilot** skip confirmation for potentially destructive actions, including file edits, terminal commands, and external tool calls. The first time you select either option, a warning dialog asks you to confirm. Use these options only when you trust the workspace and understand the [security implications](/docs/agents/run/security.md).

### How Autopilot works

**Autopilot** is an agent mode, not a permission level. Select it from the mode picker in the chat input to let the agent work autonomously until it determines that the task is complete. Autopilot:

* Auto-approves all tools, like **Allow all**.
* Retries when it encounters errors.
* Responds automatically to questions that would otherwise block progress.

> [!NOTE]
> **For Local harness sessions:** **Autopilot** is a permission level rather than an agent mode. Select it from the permissions picker.

### Advanced autopilot (Preview)

Advanced Autopilot delegates the completion decision to a separate model. After each turn, a small, fast model evaluates whether the original request is complete and guides the next turn when more work is needed. Set `setting(chat.autopilot.advanced.enabled)` to `true` to use this preview feature.

> [!NOTE]
> Autopilot consumes AI credits like interactive chat. Learn more about [usage-based billing](https://docs.github.com/en/copilot/concepts/billing/usage-based-billing-for-individuals).

### Claude permission modes

[Claude harness sessions](/docs/agents/run/agent-harnesses.md#claude) support these permission modes:

* **Edit automatically**: apply changes without asking for approval.
* **Request approval**: ask before applying changes.
* **Plan**: outline the approach before implementation.

> [!CAUTION]
> The `setting(github.copilot.chat.claudeAgent.allowDangerouslySkipPermissions)` setting bypasses all permission checks. Use it only in an isolated sandbox environment without internet access.

### Codex approval presets

The [direct Codex integration](/docs/agents/run/agent-harnesses.md#codex) provides these approval presets. For the extension-based integration, use the OpenAI Codex extension's documentation.

* **Default Permissions**: read and edit workspace files and run routine local commands. Codex asks before using the internet or accessing resources outside the workspace.
* **Auto-Review**: use the same workspace access as **Default Permissions**, but send approval requests to an automatic reviewer instead of prompting you.
* **Full Access**: edit files outside the workspace and use the internet without asking.

> [!CAUTION]
> **Full Access** gives Codex unrestricted disk and network access. Use it only when you intend to give the agent full access to your machine.

### Allow all tools globally

To auto-approve tools across all workspaces, enable `setting(chat.tools.global.autoApprove)`. To bypass approvals only for the current supported local or Copilot CLI session, use `/yolo` or `/autoApprove`. Use `/disableYolo` or `/disableAutoApprove` to restore the session's default permission level.

Prefer the session-scoped **Allow all** level when you do not need auto-approval in every workspace.

> [!CAUTION]
> Global auto-approval removes confirmation prompts in every workspace. Only enable it if you understand the [security implications](/docs/agents/run/security.md). The first time you enable it, a warning dialog asks you to confirm.

## Tool approval

Some tools can modify your environment or access external services. Their results can also contain prompt injection attempts. Tool approval protects against both risks.

When approval is required, review the tool name and input parameters, then approve a single use or grant approval for the session, workspace, or all future invocations.

![Screenshot of a tool confirmation dialog showing tool details and approval options.](../images/approvals/chat-approve-tool.png)

For files that contain secrets or sensitive configuration, require explicit approval for [edits to sensitive files](/docs/agents/run/review-code-edits.md#edit-sensitive-files).

> [!IMPORTANT]
> Always review tool parameters carefully before approving, especially for tools that modify files, run commands, or access external services. See the [Security considerations](/docs/agents/run/security.md) for using AI in VS Code.

### Manage tool approvals

Run **Chat: Manage Tool Approval** from the Command Palette (`kb(workbench.action.showCommands)`) to review and configure approvals. Tools are grouped by source, such as an MCP server or extension.

| Approval | Effect |
|---|---|
| **Pre-approval** ("without approval") | Runs the tool without a confirmation dialog. |
| **Post-approval** ("without reviewing result") | Adds the tool result to the chat context without review. Use caution with external data that might contain prompt injection. |

Expand a source to configure approvals for individual tools, or select the top-level checkboxes to trust all tools from a specific MCP server or extension at once.

### Prevent tools from being auto-approved

Set a tool to `false` in `setting(chat.tools.eligibleForAutoApproval)` to always require manual approval. The confirmation dialog then does not offer an auto-approval option for that tool.

Organizations can also use device management policies to enforce manual approvals for specific tools. Learn more in the [Enterprise documentation](/docs/enterprise/manage-ai-settings.md).

### Reset tool confirmations

Run **Chat: Reset Tool Confirmations** from the Command Palette (`kb(workbench.action.showCommands)`) to clear all saved approvals. To change individual approvals, use [**Chat: Manage Tool Approval**](#manage-tool-approvals).

## URL approval

When a tool accesses a URL, such as the `#web/fetch` tool, VS Code separates approval into two decisions:

| Step | What you approve | Protection |
|---|---|---|
| **Request approval** | Contacting the URL or domain | Prevents data from being sent to an untrusted site. |
| **Response approval** | Adding the fetched content to the chat context | Helps prevent prompt injection from untrusted content. |

![Screenshot of a URL approval dialog showing URL details and approval options.](../images/approvals/chat-approve-url.png)

For each step, you can approve once or automatically approve future requests or responses for the URL or domain. Approving a request does not approve its response.

Request approval uses the [Trusted Domains](/docs/editing/editingevolved.md#outgoing-link-protection) list. A trusted domain does not require request approval, but its response still requires review unless you separately auto-approve responses for that domain.

Use `setting(chat.tools.urls.autoApprove)` to store exact URLs, glob patterns, or wildcards. Set a pattern to a boolean to control both steps, or use `approveRequest` and `approveResponse` to control them separately.

URL auto-approval examples:

```jsonc
{
  "chat.tools.urls.autoApprove": {
    "https://www.example.com": false,
    "https://*.contoso.com/*": true,
    "https://example.com/api/*": {
      "approveRequest": true,
      "approveResponse": false
    }
  }
}
```

## Automatically approve terminal commands

The agent uses one tool to run any [terminal command](/docs/agents/run/tools.md#run-terminal-commands). To avoid granting that tool unrestricted approval, VS Code evaluates each command separately.

By default, common read-only commands run automatically, while risky commands such as `rm` and `del` require approval. Add rules to `setting(chat.tools.terminal.autoApprove)` to change this behavior:

* Set a command to `true` to auto-approve it.
* Set a command to `false` to require approval.
* Wrap a regular expression in `/` characters to match a command pattern.

For example:

```jsonc
{
  // Allow the `mkdir` command
  "mkdir": true,
  // Allow `git status` and commands starting with `git show`
  "/^git (status|show\\b.*)$/": true,

  // Always require approval for the `del` command
  "del": false,
  // Always require approval for commands containing "dangerous"
  "/dangerous/": false
}
```

A `false` rule requires approval. It does not block the command. To block a terminal tool call in the Local harness, use a [Preview `PreToolUse` hook](/docs/agents/reference/hooks-reference.md#pretooluse) that returns `permissionDecision: "deny"`.

By default, rules match each subcommand. A compound command is auto-approved only when all its subcommands match a `true` rule and none match a `false` rule. A `false` rule always takes precedence.

To evaluate the full command line instead, use object syntax and set `matchCommandLine` to `true`.

Related settings:

* Disable `setting(chat.tools.terminal.enableAutoApprove)` to require approval for every command.
* `setting(chat.tools.terminal.blockDetectedFileWrites)` `feature(terminal-block-detected-file-writes)` defaults to `outsideWorkspace`, which requires approval for detected writes outside the workspace. The OS temporary folder (`/tmp` on macOS and Linux, `%TEMP%` on Windows) is exempt when session-level command approval is active.
* Enable the experimental `setting(chat.tools.terminal.ignoreDefaultAutoApproveRules)` setting to ignore the built-in rules and use only your rules. Built-in deny rules are designed to protect against dangerous commands.

> [!CAUTION]
> Terminal auto-approval is a best-effort convenience, not a security boundary. Command detection has these limitations:
>
> * The PowerShell and bash tree-sitter grammars might not identify every subcommand.
> * zsh and fish commands are parsed with the bash grammar, which can miss syntax differences.
> * File write detection is limited, and obfuscated commands can evade matching.
>
> If prompt injection is a concern or you work in a high-risk environment, [sandbox agent commands](#sandbox-agent-commands) or run VS Code in a container.

## Sandbox agent commands

> [!NOTE]
> Agent sandboxing is in Preview on macOS, Linux, and WSL2, and Experimental on Windows.

Agent sandboxing restricts file system and network access for terminal commands. It is independent of the selected permission level, so an enabled sandbox continues to restrict terminal commands with **Allow all** and **Autopilot**.

In a Copilot harness session, select **Sandboxing for terminal** in the permissions picker to turn sandboxing on or off for that session. New sessions use the effective sandbox configuration on the machine where commands run, and an explicit session selection persists when you restore the session. Managed settings can require sandboxing and disable the toggle.

Restart VS Code after you change `setting(chat.agent.networkFilter)`, `setting(chat.agent.allowedNetworkDomains)`, or `setting(chat.agent.deniedNetworkDomains)` to ensure new integrated browser sessions use the updated network policy.

Learn how to [configure agent terminal sandboxing](/docs/agents/run/agent-sandboxing.md), including platform prerequisites, file system and network restrictions, session behavior, and fallback controls.

## Related resources

* [Use tools with agents](/docs/agents/run/tools.md)
* [Security considerations for using AI in VS Code](/docs/agents/run/security.md)
* [Trust and safety concepts](/docs/agents/concepts/trust-and-safety.md)