In AGI Desktop the agent asks first, and nineteen tools ask every time.

On the website the default is Skip approvals: eligible reads, searches, and sandboxed code run on their own, while destructive actions and connector tools AGI does not know still ask.

• ModeIn Safe and Plan, AGI Desktop may call only read-only tools, so a write is refused before a prompt is even offered.
• DefaultA connector tool you have never ruled on is Needs approval. A write-shaped name defaults to Blocked instead.
• The askThe request carries the tool name, the arguments the model actually wrote, and a risk level.
• SilenceThe desktop dialog holds the call open for 120 seconds and then cancels it. It is never counted as a yes.
• ReachInside Local mode the CLI will only open a stdio MCP server; SSE and Streamable HTTP are network egress and are not offered there.

Always allow, an approval scoped to the session, and Autopilot are one grant at three lengths. Nineteen tools are excluded from all three and prompt again on every call: the ones that rewrite the permission model itself, the ones that run code or write to your disk, and the ones that publish or destroy data outside the app. Every MCP tool is excluded as well, because what a tool does is decided by a third-party server.

set_auto_approve_all, set_agent_mode:autopilot, set_tool_approval_policy, execute_code, code_execute, file_write, file_write_text, file_write_binary, file_open_with_default_app, terminal_execute, folder_access, playwright_evaluate, email_send, git_push, cloud_upload, db_execute, browser_execute_async_js, browser_evaluate, browser_execute_in_frame

That list is a constant in the desktop source with a test pinning it entry for entry. What the agent may do without asking on each surface is written out at the permission reference.

• Filepermissions.toml under ~/.agiworkforce, written with owner-only file permissions on macOS and Linux.
• Commandsagi approvals list prints its Allow, Ask, Deny and Workspace tabs; allow, deny, session and remove edit them; export and import carry them to another machine; reset clears them.
• MatchingBy whole token, deny checked before allow. A command containing a newline matches no stored rule, so an allow for git status cannot be ridden by a second line.