An agent that can edit files and run commands can do anything you can do. Every coding agent therefore has some answer to "what may it do without asking", and the answers differ more than the marketing suggests.
The two bad extremes
Approve everything. Safe on paper. In practice you approve forty prompts in ten minutes, you stop reading them somewhere around the eighth, and by the twentieth you are a rubber stamp with a keyboard. A permission prompt you always approve is not a control, it is a delay that has trained you out of caution.
Approve nothing. Fast, and fine for a task you have fully understood in advance. Not fine as a default, because the failure mode is unbounded and silent.
The whole design problem is finding a middle that stays meaningful after the hundredth prompt.
Splitting by tool type, and why it disappoints
The obvious middle: file edits are safe, shell commands are dangerous, so auto-approve edits and prompt on commands.
It sounds right and it does not survive contact with real work, for two reasons.
Commands are most of what an agent does. Running the tests, checking a type, listing a directory, grepping. A mode that silences edits but stops at every command still stops constantly, which means it still trains you to stamp.
A file edit is not inherently safer than a command. Writing to ~/.zshrc is a file edit.
Overwriting a file outside the project is a file edit. ls is a command. The tool type is a poor
proxy for the risk.
Splitting by reach
The better axis is containment: not what kind of operation it is, but whether it stays inside the workspace the agent was given.
- Inside the working directory: edit, run, install, build, break things. It is a branch in a
worktree. Undoing it is
git checkout. - Outside it: ask. Writing to your home directory, reading a path outside the checkout, touching another project.
This holds up over a long session in a way tool-type splitting does not, because the prompts you do get are rare and each one is genuinely interesting. That is the property you want: a prompt that appears once an hour gets read.
It needs a real boundary to be worth anything, which is why isolation and permissions are the same conversation: see why parallel agents need isolation.
Two things should never be automatic
Whatever else a mode allows, two decisions are structurally yours.
Approving a plan. A plan is the agent asking whether its interpretation of your request is right. A system that approves that automatically has removed the one checkpoint that catches a misunderstanding before it becomes 2,000 lines of code.
Answering a question. When an agent asks which of two approaches you want, there is no correct answer available anywhere except from you. An auto-answer is a guess wearing your authority.
Notice both are answered by a human providing input, not by a policy providing permission. They are a different kind of thing from a tool approval, and a design that treats them as tool approvals will eventually auto-approve one.
Blast radius beats prompt count
The question to ask about any agent setup is not "how often does it ask" but "what is the worst thing one turn can do, and how do I undo it".
If the answer is "edit a branch in a scratch directory, and I undo it with git", you can afford a loose permission mode. If the answer is "anything on my machine, and I find out later", you cannot, regardless of how many prompts you get.
Things that shrink the radius: a working directory that is not your main checkout, a branch that is not your main branch, a snapshot before each turn, and a diff you actually read at the end.
Where Fleet fits
Fleet has four modes: Plan, Ask, Auto and Bypass.
Auto is built on the containment axis rather than tool type. It allows tool use without asking, and anything reaching outside the session's worktree still prompts. Bypass removes that check too, which is the real difference between them.
Plans and questions are never answered automatically, in any mode, including Bypass. And the blast radius is shrunk on purpose: a worktree that is not your checkout, a branch that is not your base, and a checkpoint before every turn. See permissions and modes.