Permissions and safety
Library permission modes
The core permission engine classifies registered tools and makes a decision before execution.
| Mode | Read tools | Other tools |
|---|---|---|
default | Allowed | Require approval |
safe | Allowed | Denied |
auto | Allowed | Allowed except dangerous tools, which require approval |
yolo | Allowed | Allowed by this decision layer; tool-level guards still apply |
These are library rules. The current CLI creates sessions with PermissionMode::Default directly; validating a different setting does not change that entry-point behavior. The simulated provider does not request coding tools.
Tool guards and data
Core tools include file access and command execution with their own input checks. Permission decisions are not an operating-system sandbox or a promise that arbitrary commands are safe. An integration must correctly connect provider selection, tool registration, approval handling, and its chosen isolation mechanism.
CLI records are local. When a real provider is integrated, requests can include user prompts, code context, and tool results. Model API keys and account sign-in tokens serve different purposes.
Historical remote approvals
The historical AgentHub SDK page describes an earlier remote approval contract. It does not establish an active TokenDance Account login or a ready-to-use approval UI in this Rust preview.