Dune / guides
Agent permissions
Decide what the agent may do on its own, what it must ask about, and what it can never do.
Allow, ask, deny
Each tool the agent can use has a rule:
- Allow runs the tool without asking.
- Ask shows an approval card in the chat. The tool runs only after you approve it.
- Deny blocks the tool.
Rules can differ per agent mode and per subagent type. For example, a reviewer subagent can read files but not edit them.
Where to set them
Open Settings ▸ Agents ▸ Permissions. Plan mode is always read-only: it can't write files or run a shell, whatever the rules say.