Manage approvals and permissions

Agents in Visual Studio Code can edit files, run terminal commands, and call external tools. VS Code uses two security layers to help you control these actions:

• Approvals determine whether an action runs automatically or requires your confirmation.
• Sandboxing restricts the file system and network resources that agent terminal commands can access, even after the commands are approved.

This article explains how these layers work together and how to configure permission levels, tool and URL approvals, terminal auto-approval, and sandboxing. For the security concepts behind these controls, see Trust and safety.

Permission levels

Permission levels control how the agent handles approvals for the current chat session. Select a level from the permissions dropdown in the chat input. You can change it at any time.

New sessions use the level configured by chat.permissions.default Open in VS Code Open in VS Code Insiders .

Assisted permissions is available only for supported sessions that run on the Agent Host. For the Copilot harness, choose Folder isolation because worktree sessions always use Allow all.

Enable the chat.assistedPermissions.enabled Open in VS Code Open in VS Code Insiders setting to show Assisted permissions in supported Agent Host permission pickers. An organization can also hide this option by disabling global auto-approval.

Sandboxing is independent of the permission level. Allow all and Autopilot skip approval prompts, but an enabled sandbox still restricts terminal file system and network access. Because sandboxing applies only to terminal commands, use tool and URL approvals to control other actions with Manual permissions.

How Autopilot works

Autopilot is an agent mode, not a permission level. Select it from the mode picker in the chat input to let the agent work autonomously until it determines that the task is complete. Autopilot:

• Auto-approves all tools, like Allow all.
• Retries when it encounters errors.
• Responds automatically to questions that would otherwise block progress.

For differences between Autopilot on the Agent Host and extension host, see Agent Host behavior.

Advanced autopilot (Preview)

Advanced Autopilot delegates the completion decision to a separate model. After each turn, a small, fast model evaluates whether the original request is complete and guides the next turn when more work is needed. Set chat.autopilot.advanced.enabled Open in VS Code Open in VS Code Insiders to true to use this preview feature.

Allow all tools globally

To auto-approve tools across all workspaces, enable chat.tools.global.autoApprove Open in VS Code Open in VS Code Insiders . To bypass approvals only for the current supported local or Copilot CLI session, use /yolo or /autoApprove. Use /disableYolo or /disableAutoApprove to restore the session's default permission level.

Prefer the session-scoped Allow all level when you do not need auto-approval in every workspace.

Tool approval

Some tools can modify your environment or access external services. Their results can also contain prompt injection attempts. Tool approval protects against both risks.

When approval is required, review the tool name and input parameters, then approve a single use or grant approval for the session, workspace, or all future invocations.

For files that contain secrets or sensitive configuration, require explicit approval for edits to sensitive files.

Manage tool approvals

Run Chat: Manage Tool Approval from the Command Palette (⇧⌘P (Windows, Linux Ctrl+Shift+P)) to review and configure approvals. Tools are grouped by source, such as an MCP server or extension.

Expand a source to configure approvals for individual tools, or select the top-level checkboxes to trust all tools from a specific MCP server or extension at once.

Prevent tools from being auto-approved

Set a tool to false in chat.tools.eligibleForAutoApproval Open in VS Code Open in VS Code Insiders to always require manual approval. The confirmation dialog then does not offer an auto-approval option for that tool.

Organizations can also use device management policies to enforce manual approvals for specific tools. Learn more in the Enterprise documentation.

Reset tool confirmations

Run Chat: Reset Tool Confirmations from the Command Palette (⇧⌘P (Windows, Linux Ctrl+Shift+P)) to clear all saved approvals. To change individual approvals, use Chat: Manage Tool Approval.

URL approval

When a tool accesses a URL, such as the #web/fetch tool, VS Code separates approval into two decisions:

For each step, you can approve once or automatically approve future requests or responses for the URL or domain. Approving a request does not approve its response.

Request approval uses the Trusted Domains list. A trusted domain does not require request approval, but its response still requires review unless you separately auto-approve responses for that domain.

Use chat.tools.urls.autoApprove Open in VS Code Open in VS Code Insiders to store exact URLs, glob patterns, or wildcards. Set a pattern to a boolean to control both steps, or use approveRequest and approveResponse to control them separately.

URL auto-approval examples:

{
  "chat.tools.urls.autoApprove": {
    "https://www.example.com": false,
    "https://*.contoso.com/*": true,
    "https://example.com/api/*": {
      "approveRequest": true,
      "approveResponse": false
    }
  }
}

Automatically approve terminal commands

The agent uses one tool to run any terminal command. To avoid granting that tool unrestricted approval, VS Code evaluates each command separately.

By default, common read-only commands run automatically, while risky commands such as rm and del require approval. Add rules to chat.tools.terminal.autoApprove Open in VS Code Open in VS Code Insiders to change this behavior:

• Set a command to true to auto-approve it.
• Set a command to false to require approval.
• Wrap a regular expression in / characters to match a command pattern.

For example:

{
  // Allow the `mkdir` command
  "mkdir": true,
  // Allow `git status` and commands starting with `git show`
  "/^git (status|show\\b.*)$/": true,

  // Always require approval for the `del` command
  "del": false,
  // Always require approval for commands containing "dangerous"
  "/dangerous/": false
}

A false rule requires approval. It does not block the command. To block a terminal tool call, use a Preview PreToolUse hook that returns permissionDecision: "deny".

By default, rules match each subcommand. A compound command is auto-approved only when all its subcommands match a true rule and none match a false rule. A false rule always takes precedence.

To evaluate the full command line instead, use object syntax and set matchCommandLine to true.

Related settings:

• Disable chat.tools.terminal.enableAutoApprove Open in VS Code Open in VS Code Insiders to require approval for every command.
• chat.tools.terminal.blockDetectedFileWrites Open in VS Code Open in VS Code Insiders Block detected terminal file writes is experimental and might change or be removed. defaults to outsideWorkspace, which requires approval for detected writes outside the workspace. The OS temporary folder (/tmp on macOS and Linux, %TEMP% on Windows) is exempt when session-level command approval is active.
• Enable the experimental chat.tools.terminal.ignoreDefaultAutoApproveRules Open in VS Code Open in VS Code Insiders setting to ignore the built-in rules and use only your rules. Built-in deny rules are designed to protect against dangerous commands.

Sandbox agent commands

Agent sandboxing restricts file system and network access for terminal commands, including Copilot agent-host sessions that use the VS Code terminal integration. It does not sandbox other agent tools. For the security model and OS-level implementation, see Agent sandboxing.

Agent terminal sandboxing is available on macOS and Linux, including WSL2 environments.

Configure the sandbox

On macOS and Linux, configure these settings:

The Sandboxing for terminal checkbox in the permission picker updates chat.agent.sandbox.enabled Open in VS Code Open in VS Code Insiders .

With the default sandbox configuration, terminal commands:

• Have read access to workspace folders, the sandbox runtime temp folder, and any per-command paths that VS Code adds automatically (for example, paths required by git, node, npm, dotnet). Reads from your home directory ($HOME) are denied by default.
• Have write access only to the current working directory and its subdirectories.
• Cannot access the network unless you configure domain access or unrestricted network access.
• Run without confirmation unless you disable chat.agent.sandbox.allowAutoApprove Open in VS Code Open in VS Code Insiders .

Configure file system access

Use chat.agent.sandbox.fileSystem.mac Open in VS Code Open in VS Code Insiders on macOS or chat.agent.sandbox.fileSystem.linux Open in VS Code Open in VS Code Insiders on Linux and WSL2 to change file system access.

Configure allowRead, allowWrite, denyRead, and denyWrite with literal paths. Glob patterns are not supported. Deny rules take precedence over allow rules.

Workspace folders, the sandbox runtime temp folder, and per-command read paths are allowed automatically. You typically only need allowRead for configuration or data outside the workspace.

{
  "chat.agent.sandbox.fileSystem.mac": {
    // Allow writes to the working directory
    "allowWrite": ["."],
    // Allow reads from an additional path outside the workspace
    "allowRead": ["/Users/me/.config/myapp"],
    // Block writes to specific subdirectories
    "denyWrite": ["./secrets/"],
    // Block reads from specific paths
    "denyRead": ["/etc/passwd"]
  }
}

Configure network access

Sandbox network isolation and the agent network filter work together:

When sandboxing is enabled and chat.agent.sandbox.allowNetwork Open in VS Code Open in VS Code Insiders is false, enable chat.agent.networkFilter Open in VS Code Open in VS Code Insiders and add allowed domains to give terminal commands selective network access. Domain lists support wildcards such as *.example.com.

When network restrictions block a sandboxed command, chat.agent.sandbox.retryWithAllowNetworkRequests Open in VS Code Open in VS Code Insiders controls the fallback. Its default value, true, prompts you to retry inside the sandbox with unrestricted network access. File system restrictions remain active.

{
    "chat.agent.networkFilter": true,
    "chat.agent.allowedNetworkDomains": [
        "api.github.com"
    ],
    "chat.agent.deniedNetworkDomains": [
        "example.com"
    ]
}

Run commands outside the sandbox

If a command cannot run inside the sandbox, the agent asks for approval to run it outside the sandbox. Disable chat.agent.sandbox.allowUnsandboxedCommands Open in VS Code Open in VS Code Insiders to prevent this elevation option.

The agent tries the command inside the sandbox first, so commands that succeed there do not produce an elevation prompt.

Related resources

• Use tools with agents
• Security considerations for using AI in VS Code
• Trust and safety concepts