---
title: "Permissions"
description: "Control tool execution with modes, rules, and session grants."
canonical_url: https://fx.sh/docs/configure-fx/permissions
markdown_url: https://fx.sh/docs/configure-fx/permissions.md
---

# Permissions

Permission settings control whether fx can change files, run commands, and access paths outside your workspace.

## Modes

| Mode | Description |
| --- | --- |
| `ask` | Ask before acting. |
| `auto` | Run routine work directly and review other actions. This is the default. |
| <code className="!whitespace-nowrap">full-access</code> | Disable fx permission checks. Shown as "full access" in the interface. |

<span id="automatic-review-configuration-and-cost" />

### Auto mode

`auto` is the default permission mode. It runs routine development actions directly and reviews other actions before running them.

**Runs directly**

- Read files and search code or the web
- Create or edit ordinary project files
- Run recognized project commands, including `git status`, local dependency installs, tests, builds, and development servers

**Reviews first**

- Run unrecognized or dynamic shell commands
- Overwrite files outside the workspace
- Change sensitive configuration
- Call an MCP server tool

For reviewed actions, fx sends the exact action to a model that checks for prompt injection or malicious behavior. If the model finds no problem, fx runs the action. If the model flags a problem or cannot finish the review, fx holds the action and tells the agent why.

The review model depends on your [provider](https://fx.sh/docs/getting-started/authentication.md#model-providers):

| Provider | Review model |
| --- | --- |
| AI Gateway | `openai/gpt-5.6-luna` by default; configurable |
| Codex | `gpt-5.6-luna` |
| Grok | `grok-4.5` |
| Custom connection | Its `reviewer_model`, or the selected model |

To choose another AI Gateway reviewer, add `review_model` to `~/.fx/settings.json`:

```json
{
  "review_model": "typesafeai/jev"
}
```

`FX_REVIEW_MODEL` overrides it for one process. The setting accepts an AI Gateway chat model ID or `typesafeai/jev`. Jev uses AI Gateway unless `TYPESAFE_API_KEY` is set, in which case fx calls TypeSafe directly. Codex and Grok use their fixed reviewers. Custom connections use their own [`reviewer_model`](https://fx.sh/docs/configure-fx/custom-model-connections.md#connection-fields).

Each model review uses tokens and can add to your [usage and costs](https://fx.sh/docs/using-fx/usage-and-costs.md#additional-model-requests). Actions allowed or denied by your rules do not need a model review.

To change how fx handles a matching action, add a [persistent rule](#persistent-rules) that allows it, denies it, or asks for your approval.

### Change the mode

In the interactive shell:

```bash
/permissions ask
```

```bash
/permissions auto
```

```bash
/permissions full-access
```

`/permissions reset` switches back to `ask` and clears the grants collected in this session.

From your terminal, inspect the effective mode and rules:

```bash
fx permissions --json
```

Use `fx ask --full-access <prompt>` to disable fx permission checks for one request.

You can also set the mode with `permission_mode` in `~/.fx/settings.json` or the `FX_PERMISSION_MODE` process override. See [Configuration](https://fx.sh/docs/configure-fx/configuration.md).

## When fx asks

In `ask` mode, unresolved sensitive calls open an approval prompt with three choices:

| Choice | Effect |
| --- | --- |
| Yes | Run this request without creating a grant. |
| Yes, and don't ask again | Run it and create a session grant for the displayed scope. |
| No | Do not run the request. |

## Persistent rules

Permission rules are stored in `~/.fx/settings.json`, either globally or under the current workspace profile. Project `.fx.json` files cannot define them.

```json
{
  "permission": {
    "*": "ask",
    "bash": {
      "git *": "allow",
      "git push *": "deny"
    },
    "edit": {
      "*": "deny",
      "docs/*": "allow"
    }
  }
}
```

Rules use wildcard matching. The last matching rule wins, and workspace rules take precedence over user-global rules.

Put broad rules before specific exceptions. In the example above, edits are denied by default and then allowed under `docs/`.

Use [`/allowlist`](https://fx.sh/docs/using-fx/slash-commands.md) in the interactive shell to inspect or change rules. Choose `local` for the current project or `user` for rules that apply across projects.

## Rules saved with a conversation

You can remember an exact allow or deny decision for a saved conversation without granting it to the whole project. In an active saved session:

```text
/permissions remember allow shell {"action":"run","command":"git status"}
```

fx shows the prepared action for confirmation. Confirming saves the rule; it does not run the command. A different command is a different action.

Use `/permissions` to inspect the saved rules and their IDs, then remove one with `/permissions revoke <rule-id>`. Revocation also asks for confirmation. These rules survive resuming the conversation. A configured deny still takes precedence over a saved-session allow.

## Session grants

Choosing "Yes, and don't ask again" creates a live session grant. It is not written to settings and is not restored by `fx resume`.

| Permission choice | Scope | Survives resume? |
| --- | --- | --- |
| Profile rule | Global or workspace | Yes |
| `/permissions remember` | One saved conversation, exact action | Yes |
| Approval prompt's session grant | Current running session | No |

If a call is denied or reviewed when you did not expect it, see [Troubleshooting](https://fx.sh/docs/using-fx/troubleshooting.md#fx-stops-before-running-a-tool).

---

[Browse all fx documentation](https://fx.sh/llms.txt)