Warp Agent CLI > Using the agent

Permissions and profiles in the Warp Agent CLI

Control what the agent can do in the Warp Agent CLI: permission request cards, auto-approve, and execution profiles in the settings file.

The Warp Agent CLI uses the same permission model as the Warp app: you decide, action type by action type, whether the agent needs your approval before it acts. This page covers how to set those permissions in the CLI, what happens when the agent asks, and how to hand it full autonomy with auto-approve. For the full permission model, including team-wide controls, see Profiles & Permissions.

How permissions work

Every action the agent proposes, such as running a shell command, editing files, or calling an MCP tool, is checked against your active execution profile before it runs. Each action type is set independently: always_ask to approve every action of that type, always_allow to let them all run, or agent_decides to let the agent act when it’s confident and ask when it isn’t.

Out of the box the CLI uses agent_decides for shell commands, file edits, file reads, and MCP tool calls, and asks before typing into a running command or launching child agents. For file edits, agent_decides still prompts every time, so you review a diff before it’s applied. A built-in command denylist sits on top: commands matching a denylist pattern, such as rm, curl, or ssh, require approval even when execute_commands is always_allow.

Set every action type to always_ask to review everything, or to always_allow for an agent that never stops to ask. Both are done by editing your execution profile.

Approving agent actions

When an action needs your approval, the agent pauses and shows a permission card with the proposed command or file edits. Beyond approving or rejecting it, you can:

Select Other to reply with guidance instead of running the action; the agent adjusts its approach based on what you type.
Press E on a command card to edit the proposed command; approving then runs your edited version. While editing, Esc exits the editor without rejecting the request.
Press E on a file-edits card to expand or collapse all diffs.

Auto-approve

Auto-approve gives the agent full autonomy for the current conversation: proposed actions run immediately, without permission cards, until the task finishes or you turn it off. Toggle it with /auto-approve or Ctrl+Shift+I, or launch with warp --auto-approve to start every new conversation in that session with auto-approve already on.

Auto-approve applies per conversation, and new conversations start with it off unless you launched with --auto-approve. To see its state at a glance, add the Auto-approve indicator to the statusline with /statusline. If your profile sets ask_user_question = "ask_except_in_auto_approve", the agent also skips clarifying questions while auto-approve is on.

With auto-approve on, the agent runs commands and applies file edits without review, and by default it also runs commands that match your own command denylist. Press Ctrl+C to stop the agent if it starts doing something you didn’t intend.

To keep your denylist in force while auto-approve is on, turn off the bypass in your settings file:

[agents.warp_agent.other]
auto_approve_bypasses_command_denylist = false

Denylist rules enforced by your team in the Admin Panel always require approval and are never bypassed, regardless of this setting.

Execution profiles

The CLI reads its permissions from execution profiles stored in its settings file. Profiles live under the agents.execution_profiles table, and the CLI always runs with the profile under the reserved default key:

[agents.execution_profiles.default]
name = "Default"
execute_commands = "agent_decides"
apply_code_diffs = "agent_decides"
read_files = "agent_decides"
command_allowlist = ['cargo (build|check|test)(\s.*)?']

Edit the file directly, or ask the agent to change its own permissions and it will update the settings file for you. The CLI picks up saved changes automatically.

Profiles in the Warp Agent CLI are local to your machine: they never sync to the cloud, and they are separate from the Agent Profiles you configure in the Warp app. You can define additional profiles in the file, but the CLI currently always runs with default.

Permission values

Most permission fields accept one of three values:

agent_decides - The agent acts on its own when it’s confident and asks when it’s uncertain.
always_ask - Every action of this type requires approval.
always_allow - Actions of this type run without prompting.

Profile fields

execute_commands - Permission to run shell commands.
apply_code_diffs - Permission to apply file edits.
read_files - Permission to read files.
mcp_permissions - Permission to call MCP servers.
write_to_pty - Permission to type into running interactive commands. Also accepts ask_on_first_write.
ask_user_question - Whether the agent may pause to ask clarifying questions: always_ask, ask_except_in_auto_approve, or never.
run_agents - Permission to launch child agents: always_ask, always_allow, or never_allow.
command_allowlist - Regular expressions for commands that run without approval.
command_denylist - Regular expressions for commands that require approval regardless of the other permission values. Auto-approve bypasses this list by default.
directory_allowlist - Directories the agent may read without approval.

Profiles also hold model overrides such as base_model, covered in Models and usage in the Warp Agent CLI.

Profiles & Permissions - The full permission model, autonomy levels, and allowlist/denylist behavior.
Configuring the Warp Agent CLI - The settings file, themes, statusline, and keybindings.
Agent conversations in the Warp Agent CLI - How tool calls, diffs, and agent questions render in the transcript.