Permissions

Which tools prompt

File reads, searches, and writes run freely in your project. Shell commands, verify, git writes, SQL mutations, MCP call_tool, and destructive browser actions normally prompt for approval (y/n). Optional files rules gate write/edit when configured.

Where rules live

Project patterns append to global; last matching rule wins.

Example

{
  "bash": {
    "*": "ask",
    "npm test": "allow",
    "npm test *": "allow",
    "rm *": "deny"
  },
  "git": {
    "commit": "ask",
    "push *": "deny"
  },
  "database": { "*": "ask", "SELECT *": "allow" },
  "mcp": { "call_tool": "ask" },
  "browser": { "*": "ask" },
  "twitter": { "post *": "ask", "reply *": "ask", "*": "allow" },
  "files": { "*": "ask", ".astra/plans/*": "allow" }
}

Rules

• verify uses the same bash rules (e.g. npm test: allow applies to both bash and verify).
• The files category is optional — without it, write and edit never prompt. Add files rules for paranoid setups.
• Shorthand: "bash": "ask" expands to { "*": "ask" }.
• Put "*": "ask" first, then more specific patterns after — last match wins.

Inspecting rules

Use /permissions to inspect the merged rules for the current project, and /settings for a rule-count summary. Read-only git commands and SELECT queries stay allowed regardless of rules.