Permission Modes

The permission mode decides which actions Andromity takes on its own and which wait for your approval. There are four: SAFE (the default), TRUST, FULL and YOLO.

Two checks run before the mode is consulted, and no mode can skip them:

1. Folder trust. In a folder you have not trusted, Andromity cannot read, search, edit or run anything in your project. Only web search, fetching URLs, asking you questions, listing tools and reading other sessions' messages still work. Trust a folder with /trust (and remove it with /untrust). In VS Code, the folder must also be trusted by VS Code itself, and Andromity asks you to confirm before it can edit files and run commands there.
2. Agent profile. The planner and reviewer profiles never write files or run commands, whatever the mode.

What each mode allowsCopy Anchor Link

In SAFE and TRUST, any tool that targets a sensitive file asks first, and read_file refuses to read one in every mode (see Limits in every mode).

Sensitive filesCopy Anchor Link

Andromity treats these paths as sensitive:

• Files named .env (and .env.*), id_rsa, id_ed25519, id_ecdsa, id_dsa, authorized_keys, known_hosts and config.toml.
• Anything inside a .ssh, .git, .aws or .gnupg directory.
• /etc/shadow, /etc/passwd and /proc/self/environ.
• File names containing secret, password, credential or token as a word, such as secrets.yaml or api_token.txt. For source files (.py, .ts, .js and similar), only files named exactly secret(s), password(s) or credential(s) count.

Execution-control filesCopy Anchor Link

Editing these can make code run later (git hooks, editor tasks, npm scripts, MCP servers), so TRUST asks before changing them:

• Anything inside .git/, .andromity/, .vscode/ or .husky/.
• Files named package.json, .envrc, .mcp.json or .gitmodules.

AllowlistsCopy Anchor Link

TRUST runs commands and fetches URLs without asking only when they are on an allowlist in config.toml:

[default]
allowed_commands = ["npm run", "npm test", "npm list", "npm run dev", "git status", "git diff", "git log", "ls", "dir", "cat", "echo"]
allowed_domains  = ["github.com"]

• allowed_commands matches by leading words: npm test also covers npm test -- --watch. The list above is the default written when config.toml is first created.
• A command is never treated as allowlisted if it contains any of ; & | $ ( ) { } < > % ^, a backtick or a line break, or if one of its arguments is a sensitive path.
• allowed_domains has no default. A domain also covers its subdomains (github.com covers api.github.com), and *.example.com works as a wildcard.

In the terminal app you can manage the command list with /mode trust add <prefix>, /mode trust list and /mode trust clear.

Approving an actionCopy Anchor Link

When Andromity asks, you can answer:

• Allow once (Ctrl+Y or Enter)
• Allow for remainder of this session (Ctrl+Alt+Y or Alt+Y)
• Always allow (Ctrl+Shift+Y), which adds the command or domain to config.toml
• Deny (Esc)

The two "remember" choices appear only for commands and URL fetches, and remembered entries are used in TRUST; SAFE always asks for commands and fetches. Approvals are refused while the folder is untrusted.

PlansCopy Anchor Link

With the builder profile, Andromity writes a plan before larger changes. In SAFE and TRUST the plan waits for you: the chat shows a Plan Review card with Approve & Execute (Ctrl+Y), Reject & Revise (Esc) and an optional note. In FULL and YOLO the plan is approved automatically and Andromity continues.

Limits in every modeCopy Anchor Link

Even in FULL and YOLO:

• read_file refuses to read sensitive files.
• Andromity cannot write outside the project folder, and reads outside it only from approved skill folders or files you attached.
• Fetching URLs on private or internal network addresses is refused, including after redirects.
• Subagents cannot start their own subagents.

FULL and YOLOCopy Anchor Link

In VS Code, FULL and YOLO behave the same: nothing asks for approval. Switching to either one asks you to confirm first.

In the terminal app, YOLO lasts for the current session only and resets to SAFE when the app restarts.

Switching modesCopy Anchor Link

• VS Code chat: the permission menu under the prompt box, or type /mode to cycle SAFE → TRUST → FULL → YOLO.
• Andromity Hub: Preferences → Permission Governance Mode.
• Terminal app: /mode safe, /mode trust, /mode full or /mode yolo.
• Config file: permission_mode under [default] in config.toml.

A turn keeps the mode it started with. If you switch while Andromity is working, the new mode applies from the next turn, and any approvals already waiting that the new mode allows go ahead right away.

Turns nobody typedCopy Anchor Link

• Cron jobs have their own mode, TRUST by default. They never stop to ask: in an untrusted folder the run fails, sensitive files are refused, and commands run only if allowlisted (in every mode except YOLO). A SAFE cron cannot edit files, stop processes or start subagents. Cron jobs that arrive in a repository's .andromity/crons.json are imported switched off, and FULL or YOLO ones are lowered to SAFE. See Cron Jobs.
• Sessions woken by another session run at their own mode, capped at TRUST.
• Subagents use their parent's mode. In SAFE they cannot edit files or run commands at all; in TRUST they can edit inside the project and run commands from the global allowlist.