Policies and default behavior

A policy combines a default behavior with an Allow List and a Deny List. One policy is active at a time.

Built-in policies

Agent Approve includes policies for common starting points. You can use one as shipped or duplicate it before making changes.

Allow All turns off list checks for that policy. Use Allow All Except Deny List when you want unmatched work to continue while keeping specific blocks in place.

Default behavior

Allow by Default can reduce manual approvals, but anything missing from its Deny List is allowed. Review the Deny List before activating it. Deny by Default is safer for a narrow workflow, but an incomplete Allow List can stop expected work.

Create a policy

1. Open Policy.
2. Open the policy selector.
3. Tap the plus button.
4. Enter a name and optional description.
5. Choose Ask User, Allow by Default, or Deny by Default.
6. Tap Create, then select the policy to activate it.

The default behavior is chosen when a policy is created or duplicated. To change that behavior later, duplicate the policy and choose a different option.

Policy page actions

Open the more menu on the Policy page for actions that apply to the policy collection.

Record any custom rules you need before resetting, then review the active policy afterward.

Duplicate Restrictive and allow ordinary work

The built-in Restrictive policy starts with more than 300 deny patterns and asks you about unmatched commands. To keep its Deny List while allowing unmatched commands:

1. Open Policy, then open the policy selector.
2. Press and hold Restrictive.
3. Tap Duplicate.
4. Give the copy a recognizable name.
5. Choose Allow by Default.
6. Tap Duplicate, then select the new policy.
7. Review the Deny List before relying on it for unattended work.

This setup approves unmatched commands automatically while keeping the copied Deny List active. Anything the Deny List does not cover will be allowed, so review the copy before using it unattended.

Edit lists

Open the active policy, choose a tool, then open the relevant list.

• Use the plus button to add a pattern.
• Swipe an entry to remove it.
• Choose Exact match, Starts with, or Contains when adding a pattern.
• Use tool-wide allow or deny controls only when every action from that tool should receive the same decision.
• Open the more menu and choose Expand all or Collapse all to change every group at once.

Matching ignores capitalization and collapses repeated spaces or tabs. Exact match checks the whole command, Starts with checks its beginning, and Contains checks for the text anywhere in the command. Test a new rule with a harmless command before leaving the agent unattended.

Native tools, MCP servers, and Global

The list browser groups observed tools by source:

• Native tools are built into the coding agent, such as shell, read, write, or edit tools.
• MCP tools belong to an MCP server. The server and tool identities are kept together so two servers can expose tools with similar names without sharing a rule accidentally.
• Global is a cross-tool pattern bucket. Global patterns can be checked against command text and the textual or JSON representation of structured tool input. Deny checks also inspect supported MCP server and tool identity. Use Global sparingly because input formatting differs between agents and tools.

Tap the plus button to select an observed tool, search the catalog, choose Global, or add a custom tool identity. For an MCP tool, open the server group and then the tool. You can create a broad server rule or add patterns to an individual tool.

Broad rules and conflicts

A native tool shows Allow All Inputs or Deny All Inputs. A server-scoped MCP entry shows Allow All Tools or Deny All Tools. When the broad switch is on, individual patterns in that entry are not needed.

Agent Approve prevents a broad allow rule when conflicting deny rules already exist for the same scope, and prevents the inverse conflict as well. Remove or narrow the opposite rule first. Adding an individual pattern to a broadly enabled entry turns off the broad switch so the pattern can control matching.

This guard prevents an Allow List and Deny List from both claiming the same whole tool or server. Narrow patterns can still overlap; when they do, a deny match takes precedence.

Decision order

For an Ask User policy, Agent Approve evaluates a normal command in this order:

1. A Deny List match denies the request.
2. If no deny rule matches, an Allow List match approves it.
3. If neither list matches, Agent Approve asks you.

This means a deny rule takes precedence when the same command matches both lists. Allow by Default checks the Deny List and approves anything else. Deny by Default checks the Allow List and denies anything else. Allow All and Deny All do not check either list.

How compound shell commands are checked

For supported shell tools, Agent Approve checks the complete command and each command it can parse from a shell sequence.

• A Deny List match in any part denies the whole request.
• Every part must match the Allow List before the whole request can be approved automatically.
• If some parts remain unmatched under Ask User, the request is sent to you.

This prevents an allowed command at the beginning of a sequence from hiding a denied command later in the same request. Dynamic scripts can still behave differently at runtime, so review the full command before approving unfamiliar work.

Manage policies

Press and hold a policy to see the actions available for that policy. A policy that uses Ask User can be renamed and its description can be edited. Policies with another fixed default behavior can be duplicated so you can choose a new behavior. The active policy and system policies cannot be removed.