Handle approvals and user input

Permission modes

The current SDKs all expose a mode that controls whether tools run immediately or stop for review.

• `interactive`: emit permission requests and wait for your app to respond.
• `unrestricted`: allow all tool execution without asking.
• `restricted`: block risky operations automatically.
• `external`: hand the decision to your own callback or policy layer where supported.

TypeScript

Approval patterns

Most apps end up using one of these shapes:

• Auto-allow read-only tools and ask on shell or write operations.
• Allow everything inside a short-lived sandboxed worker.
• Deny dangerous tools and return a manual follow-up task to a human.
• Remember a decision for a single session while a review flow stays open.

Selective approval

Best practices

• Make your approval UI show the tool name, description, and working directory.
• Do not silently auto-allow shell commands unless the agent is inside an explicit sandbox boundary.
• Keep the permission mode close to the job. Read-only review jobs and write-enabled refactor jobs should not share the same default.
• Log every allow or deny decision if the run matters for CI, auditing, or customer support.