Give Your AI Agent a Short Leash: 5 Permission Settings to Check Today

Step 1: Write deny rules first (Claude Code)

Claude Code keeps permission rules in settings.json, under three lists: permissions.allow, permissions.ask and permissions.deny. Here’s a starting point:

{
  "permissions": {
    "deny":  ["Read(./.env)", "WebFetch"],
    "ask":   ["Bash(curl *)"],
    "allow": ["Bash(npm run test *)"]
  }
}

This blocks reading your .env secrets file and web fetches, asks before any curl command, and lets your test script run without a prompt.

The order matters more than you might expect. The docs say: “Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn’t change the order.” So a narrow allow rule can’t punch a hole in a broad deny rule. If something is denied, it stays denied.

Treat the example as a pattern, not a finished policy. Rule syntax is detailed, with wildcards and compound commands, so adapt the patterns to your project, check them against the docs, and test that each rule does what you expect.

Step 2: Pick the right permission mode (Claude Code)

Rules cover specific tools. The permission mode sets the overall posture. Claude Code has six:

• default: auto-approves reads only, and asks for the rest. The CLI and apps call it Manual.
• acceptEdits: also allows file edits and common filesystem commands, such as mkdir and mv.
• plan: reads only (plus commands a safety classifier approves, where auto mode is available), for exploring before you change anything.
• auto: allows everything, with background safety checks instead of prompts.
• dontAsk: allows only tools you pre-approved, and denies everything else instead of prompting.
• bypassPermissions: skips prompts.

For sensitive work, stay in default or plan. Keep bypassPermissions for a throwaway container: the docs say to use it only in isolated environments like containers or VMs without internet access.

dontAsk is worth a look for scripted jobs. Nobody is there to answer a prompt, so it’s better for anything you didn’t pre-approve to fail closed.

For admins: you can switch the risky modes off for everyone. Set permissions.disableBypassPermissionsMode or permissions.disableAutoMode to "disable". The docs say this is most useful in managed settings, where individual users can’t override it.

Step 3: Make ChatGPT ask before new websites

ChatGPT’s cloud browser asks before it accesses a new website by default. Check that nobody changed it:

1. Open Settings > Cloud browser.
2. Choose Always ask. The other options are Auto approve, which pauses only if a URL seems unsafe, and Always allow, which OpenAI itself labels “This is not recommended”.
3. Add per-site rules. You can allow or block individual sites, and those choices override the default. Block any site you never want an agent to touch.

“Always ask” is the setting that would catch an agent wandering to a dashboard you didn’t send it to. Each new site becomes a question you answer.

Step 4: Confirm consequential actions yourself

Website access is only half of it. OpenAI’s help page says: “Website access permission is separate from approval for consequential actions.” ChatGPT asks you to confirm in chat before actions like confirming a booking or making a payment. Read those confirmations rather than tapping through them.

In Grok Bot, the same job is done by Auto-review, according to the changelog:

• Auto-review checks actions and raises approval cards. Each card describes the action in one sentence, names the app, and flags irreversible or sensitive changes.
• If you deny a card, the bot stops and doesn’t try that action again until you send another message.
• Your wording counts. Auto-review no longer waves through an action your request said to stop before, such as sending a message you asked only to draft. So say “draft, don’t send” when that’s what you mean.
• Emails and Slack messages you ask for go out once Auto-review allows them. Sends that come up on routine turns wait as drafts.

Step 5: Keep credentials out of the chat

The incident turned on a credential, so this is the setting to take most seriously.

• ChatGPT: sign-in uses a secure form. Credentials “are not visible to the model”, and ChatGPT doesn’t store them. Never paste passwords, codes or payment details into the chat itself.
• Clear old sessions: cloud-browser sessions last until they expire. Clear them in Settings > Cloud browser > Browser data > Cookies when you’re done with a site.
• Grok Bot: the Vault, added in v0.75.5, saves logins, cards and contact info in Settings, and the bot fills them in to sign in or check out. Save only what the bot really needs.
• Spending: Grok Bot lets you save a spend limit. Set one.
• Claude Code: deny reads of secret files, as in Step 1.