Talk to Your Agents · 03.02
Permission Modes: Ask, Plan, Auto
Sticky Ask, Plan, and Auto autonomy modes, and the novelty-based intelligent stop that decides when an agent has said enough.
Three modes, one grammar, everywhere
Every conversation carries a ChatPermissionMode: ask, plan, or auto. The same three slash commands — /ask, /plan, /auto — set it whether you're in the web composer or replying over Telegram, because the parsing lives in one shared helper used by both the HTTP chat route and the channel dispatcher. The mode is sticky per conversation: set it once, it holds until changed.
| Mode | What actually happens |
|---|---|
ask (default) | Workflow runs and any mutating tool not explicitly marked autoExecute pause for your confirmation before running. |
plan | The agent is instructed not to mutate state this turn; mutating calls are also blocked upstream at the tool-registry level, so a model that ignores the instruction still can't act. |
auto | Nothing pauses for confirmation — the operator has opted into free action. |
Why 'ask' isn't as annoying as it sounds
If every mutating tool paused for a click, Ask mode would be unusable. It doesn't: a tool flagged autoExecute — one you effectively already requested, like build_workflow right after asking "build me X" — runs without a second confirmation. The friction is reserved for actions you didn't explicitly ask for. Want the agent to propose before acting on anything at all, explicit or not? That's what Plan mode is for.
Plan mode's output contract
A Plan-mode reply isn't just prose — it's required to wrap its proposal in a <proposed_plan> block, and for design-shaped requests (workflow, extension, app, system, pipeline, integration), a machine-readable <architecture_canvas> JSON block describing nodes, edges, and lanes immediately after it. If a model skips the canvas on a design-shaped request, a backstop issues one cheap follow-up completion asking specifically for the missing JSON and splices it in — so the visual plan preview doesn't silently disappear just because a model forgot the format.
One override even Auto mode can't waive
If a turn ingests untrusted content — a web page, a file, an MCP tool result, a channel message — and that content is flagged by the platform's prompt-injection scan, a small set of high-impact tools (creating an extension, sending a channel message, adding an MCP server, deploying, creating an agent) require operator confirmation regardless of permission mode, Auto included. See Prompt Injection Defense for the scan itself — this is the enforcement point where that scan actually changes behavior.
Continue
One universal chat harness backs every channel, so permission modes and turn behavior are identical whether you're on the dashboard, Slack, or WhatsApp.
The per-agent terminal pane: direct operator-to-agent messaging and history, realtime over the conversation room.