Permissions & Approvals
The trust model: how PandaOS decides when to ask before acting, and the layered system that keeps you in control.
The trust spectrum
Every AI coding tool faces the same question: how much should it do on its own? Too little autonomy and you are approving every keystroke. Too much and it might delete a production database before you can blink.
PandaOS solves this with interaction modes - a per-message or per-project setting that controls how much Panda checks in with you:
- Default - asks before applying file edits and before running commands. The safest starting point for unfamiliar projects.
- Auto-Edit - applies file edits automatically but still asks before running any shell command. Good for active development where you trust the edits but want to review commands.
- Agent - full autonomy. Panda works end to end without interrupting you. Best for well-scoped tasks with clear outcomes.
- Plan - drafts a complete plan and waits for your approval before touching anything. Best for high-stakes changes. See Plan Mode.
You can switch modes at any point, even mid-conversation. Use Agent mode for a straightforward feature, switch to Plan mode when you hit a tricky migration, switch back.
The deeper layers: permissions and sandbox
Interaction modes control when Panda asks. Two deeper layers control what it can do at all:
- Permissions mark each tool capability as allowed, ask-first, or blocked entirely. You can set these globally and override them per project. For example, you might allow file reads everywhere but block destructive shell commands in your production project.
- Sandbox limits which parts of the filesystem Panda can access and which network endpoints it can reach.
These layers stack. Even in Agent mode (full autonomy), Panda still respects your permission rules and sandbox boundaries. Agent mode means "don't ask me about things I have already allowed" - it does not mean "do whatever you want." This layered design lets you grant broad autonomy for routine work while maintaining hard guardrails where they matter.
Questions and approvals in practice
Two types of interactive cards appear in the conversation:
Question cards appear when Panda encounters genuine ambiguity - which of two valid approaches you prefer, which file to target, which database table to use. Instead of guessing (and potentially doing the wrong thing), it asks. You pick an option and Panda continues with your answer. Questions keep Panda aligned with your intent on ambiguous requests without forcing you to over-specify everything upfront.
Approval cards appear when Panda wants to take an action that your current interaction mode requires permission for - a file edit in Default mode, or a shell command in Auto-Edit mode. You can allow or deny each action individually.
The frequency of these cards is directly controlled by your interaction mode. If you find yourself approving every action, switch to a more autonomous mode. If you want more checkpoints, switch to a more cautious one. The right setting depends on the task, not a global preference.