> For the complete documentation index, see [llms.txt](https://docs.nimbalyst.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nimbalyst.com/open-safe-private-secure/permissions-and-safety.md).

# Permissions and Safety

### Why Permissions Matter

AI agents can execute code, modify files, and run shell commands. Without guardrails, a prompt injection or mistake could delete files, leak secrets, or run malicious code. Permissions ensure you stay in control.

### Claude Code's Built-in Permissions

Claude Code uses settings files to define what the agent can do:

* **`.claude/settings.json`** - Project settings (shared with team)
* **`.claude/settings.local.json`** - Personal project settings (gitignored)
* **`~/.claude/settings.json`** - Global user settings

Each file can specify:

* `allow` - Patterns that auto-approve
* `deny` - Patterns that always block
* `additionalDirectories` - Folders outside the project the agent can access

Nimbalyst supports this.

### What Nimbalyst Adds

In addition, Nimbalyst adds a **workspace trust layer** on top of the coding agent's permissions:<br>

1. **Trust Gate** - Projects must be explicitly trusted before the agent can do anything
2. **Permission Modes** - Choose how much autonomy to grant the agent
3. **Inline Confirmations** - Approve or deny actions as they happen

### Permission Modes

When you first use an agent in a project, Nimbalyst presents four autonomy levels:

| Mode                             | Behavior                                                                                                                                                      |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Agent-verified** (Recommended) | Routine work proceeds without interrupting you. Risky or uncertain actions are evaluated by the provider's automatic reviewer and can still require approval. |
| **Allow everything**             | Operations run without approval prompts or automatic review. Use only in a project and environment you fully trust.                                           |
| **Allow edits only**             | File edits proceed automatically. Shell commands and web requests ask first.                                                                                  |
| **Ask every time**               | Approve each agent action before it runs. Your saved approvals are remembered.                                                                                |

**Agent-verified** is the default. It keeps normal workflows moving while retaining a second review step for destructive or uncertain operations. Claude Agent and OpenAI Codex use their native automatic reviewers behind the same Nimbalyst mode.

### Allowing Web Searches in Allow Edits Only

To allow your coding agent to search and fetch websites, add approved domains to the URL allow list in Agent Permissions. You can use wildcard domain patterns such as `*.github.com` to allow subdomains, or use **Allow All Domains** when broad web access is appropriate for the project.

<figure><img src="/files/bldAdPwPEKhPDN1gNJws" alt=""><figcaption></figcaption></figure>

### How Approval Works in Ask Every Time

When the agent wants to perform an action in **Ask every time**:

1. An inline confirmation appears with the action details
2. You choose:

* **Deny** - Block this request.
* **Allow Once** - Allow only this request.
* **Session** - Allow the displayed pattern until you close Nimbalyst.
* **Always** - Save the displayed pattern to `.claude/settings.local.json`.

### Managing Permissions

Open **Settings > Project > Agent Permissions** to:

* Change your permission mode
* View and remove approved patterns
* Add additional directories
* Reset to defaults

Permissions are project-specific. Giving an agent more autonomy in one repository does not grant the same access in every project.

### Pattern Examples

* `Bash(git:*)` - Allow git commands
* `Bash(npm:*)` - Allow npm commands
* `Edit` - Allow file edits
* `WebFetch(domain:github.com)` - Allow fetching from github.com

### Security Notes

* Sensitive paths (`~/.ssh`, `~/.aws`, etc.) are always blocked
* Compound bash commands get one-time patterns that don't persist
* Untrusted projects deny agent actions until you choose a permission mode

<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.nimbalyst.com/open-safe-private-secure/permissions-and-safety.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.