Permissions

An autonomous agent is only useful if you can bound it. Forge decides every tool call the same way: the tool's risk level, adjusted by pattern matching on what it is actually about to do, resolved against the approval mode you chose. Nothing here depends on the model being well-behaved.

Three risk levels

The line that matters is between the second and the third. A write can be inspected and fixed by the agent that made it; a destructive call throws work away, and no amount of iteration gets it back. Only the third class needs you by default.

Approval modes

$ forge --cautious "refactor the config loader"$ forge "fix the failing auth test"        # auto, the default$ forge --yolo "run the migration and fix what breaks"

Start in cautious on an unfamiliar repository. You will see exactly how the agent works, and you can move to auto once its first move stops surprising you.

How a call is decided

The checks run in this order, and the first one that applies wins.

• Deny list - matches are refused outright. No mode and no allow-list overrides this.
• Escalation - a command matching a dangerous pattern is promoted to destructive, whatever its tool's nominal level.
• Allow-list - calls you have explicitly permitted run without asking again.
• Mode - the resulting level is looked up against the table above: run it, or ask.

Always refused

These patterns are rejected in every mode, including yolo. They are the operations with no legitimate place in an automated coding task - machine-level destruction, privilege escalation, and publishing.

git push is on that list deliberately. Forge commits; you publish. See Git.

Escalated to destructive

These are allowed but always reach a human in cautious and auto. They are the commands that are ordinary in a shell and expensive to get wrong in an unattended loop.

Note | sh and | bash in that list. Piping a downloaded script into a shell is exactly the kind of call that deserves a human, including when the script is Forge's own installer.

What an approval looks like

You see the tool, the level, and the exact call - the command as it will run, not a paraphrase.

⚠ shell  -  destructive   rm -rf build/ dist/   Approve this call?  [y/N]

Declining is not a failure. The refusal goes back to the model as a result, and it generally proposes another way to get the same thing done.

Choosing a mode

Use cautious when

• You are new to Forge, or the repository is new to you.
• The tree is dirty and you have work you cannot afford to lose.
• The task touches infrastructure, migrations, or anything with a blast radius.

Use yolo when

• The run is in CI, a container, or a scratch clone.
• Everything is committed, so the worst case is git reset.
• Nobody is at the terminal, and a prompt would just hang the job.