Use one policy across your agents

Agent Approve keeps one policy active for your account. Connected integrations in Approval Mode use that policy instead of maintaining a separate list for each coding tool.

Choose a starting policy

1. Open Policy in the iOS app.
2. Open the policy selector.
3. Choose Permissive when common low-risk commands should continue automatically and other actions should ask you.
4. Choose Restrictive when you also want the shipped destructive patterns denied automatically.
5. Duplicate a policy before making substantial changes so you can return to the shipped version.

Read Policies and default behavior before using Allow All, Deny All, or one of the exception-based policies.

Add rules that travel with you

Use Remember decisions during an approval or edit the active policy directly. A remembered approval adds a rule to the Allow List. A remembered denial adds a rule to the Deny List.

Choose the narrowest useful scope. A rule for one exact command or command prefix is safer than allowing every input to a shell tool. A Contains rule can match text in an unexpected position, so test it with harmless requests before leaving agents unattended.

Verify more than one integration

1. Confirm the intended policy is active.
2. Send a harmless, unmatched request from one connected agent and review the result.
3. Send an equivalent harmless request from a second integration.
4. Open each event and confirm which rule or default behavior made the decision.

The same policy does not make every integration identical. Agents report different tool names, inputs, and event types, so a rule that matches one integration may need a different scope for another. Use the capability matrix and test important rules with harmless requests.

The active policy is currently account-wide. You cannot select a different active policy for one agent, computer, or Hermes profile.