Approvals & modes

Shrevix’s default safety model is simple: mutating actions wait for you. Explicit mode choices and MCP server allowlists can change that policy. The gate is enforced in the engine — not by asking the model nicely.

What’s gated and what isn’t

Action	Gated?	What you see
Read / list / search files	No	A compact transcript row; files open in File explorer
Search knowledge or the web	No	A transcript row with the result
Write or edit a file	Yes	The full diff + a permission card
Run a shell command	Yes	The exact command before it runs
Call an MCP tool	Yes (default)	Server, tool, and arguments

write filecore/auth.pywaiting for approval

- return refresh(token)+ if (token.expiresSoon()) refresh(token) return token

ApproveDeny

A gated write: one tool event, the code diff, then Approve or Deny.

• Approve applies exactly what you saw — no more, no less.
• Deny rejects the action. The agent sees the denial and adjusts course; you can tell it what to do instead in the next message.

Plan mode

Plan mode blocks built-in file mutations and shell execution, so the agent can investigate, search, and propose without changing the local workspace. Toggle Plan in the composer.

A write approval stays in the turn that requested it, with the exact diff and the current message mode visible together.

Use it when you want a design or diagnosis before local edits and commands. For example, “plan a migration to Postgres” can produce a proposal without changing the workspace. Review the MCP exception below before relying on Plan for connected external systems.

Caution

Plan mode does not override a server’s explicit MCP autoApprove allowlist. An allowlisted external tool can still run according to that server policy. Remove the allowlist when you need every MCP call to wait.

Bypass mode

Bypass mode auto-approves actions for the rest of the session — useful when you trust the task and want speed. Choose Bypass from the composer’s mode control.

Caution

Bypass removes the human gate entirely. Prefer plan mode + approvals for anything you wouldn’t want to re-do from a git reset.

Delegation never escalates

When a lead agent delegates work to another agent, the child runs with its own permission level — never more than you granted. Approvals bubble up to you, not to the parent agent.

Resolved approvals stay compact. The transcript keeps the action and outcome, but does not repeat the approval reason, duplicate the write diff, or add a success check mark that competes with the actual result.