Skip to main content
Permission modes control approval before Step Code executes tools. Project resources, model services, and external tools also need appropriate access to your files and credentials.

​
Permission modes

Starting with v0.1.4, the interactive interface provides these modes: Both automatic modes enable automatic retry after model errors by default, with a retry limit. Ask and Approve for Me require confirmation for detected dangerous or unanalyzable commands. Full Access skips such per-call confirmation after risk confirmation; per-tool deny or confirm rules still apply. Rule checks cannot cover arbitrary scripts or all dangerous behavior and are not a sandbox.

​
Choose a permission mode

Full Access allows risk-bearing commands to run directly. Check the working directory, accessible credentials, and file scope before enabling it, and back up important data.
Full Access is not entered without risk confirmation, and a run without an interactive interface does not obtain Full Access from configuration alone. Permission modes are not an OS sandbox.
  1. Enter /permissions in the interactive input box.
  2. Choose a mode for the task. Start with Ask when working on an unfamiliar project, and inspect tool arguments before approving an operation.
  3. Review the mode when the task scope changes. Shift+Tab and /permissions cycle also cycle modes.
In Ask mode, approval or rejection applies to the requested tool call. Rejection cancels that call and returns the reason to the model. A batch can request confirmation for individual calls.

​
Trust project resources

Project trust controls whether Step Code loads project configuration, extensions, and resources. Manage trust with /trust. The CLI options --approve and --no-approve control whether trust-dependent project resources load for that launch. Inspect the project’s .stepcode/ configuration and resources before trusting it. See Project instructions for instruction discovery and Configuration files for settings precedence.

​
Limit available tools

For project analysis, select Ask and describe the files in scope. Use --tools or --exclude-tools to restrict tool availability, with names that match the registered tools. See Built-in tools. defaultTools manages native built-in tools. Step tools, extensions, and MCP tools also require their respective configuration. For MCP, filter tools with enabled_tools and disabled_tools; see Tool names and filtering. Permission modes and tool filters do not provide OS-level isolation. Use containers, virtual machines, or OS permissions when running untrusted code or enforcing file and network boundaries.

​
Configure unattended approval

step -p has no interactive approval dialog. Set the task’s approval policy with --approval-mode and --non-interactive-approval, and specify which tools it can use. See The step command for syntax. --non-interactive-denial controls what happens after an operation requiring human confirmation is denied. The default, terminate, ends the task. continue returns the failure to the model so it can try another approach under the selected permission policy.

​
Protect data and credentials

  • Model requests send prompts, relevant files, and tool results. Check that the receiving service is authorized to process the material.
  • MCP servers and plugins can run local programs or contact external services. Load trusted sources and grant only necessary credentials.
  • Logs and exported sessions can include code, paths, and error details. Review them before sharing.
See Data paths for local storage and cleanup.