Reference
AI coding agents: permission and safety settings
An AI coding agent can read your files, run commands, and change your code. The settings below decide how much of that it may do without asking. This page compares how three command-line agents handle approval, where they can act, and how to switch safety off. It was compiled from each tool's own --help output and, where we could read it, official documentation. It does not rank the tools. ZIV LABS is not affiliated with Anthropic, OpenAI, or Google, and the product names belong to their owners.
What we checked
| Tool | Version | Sources |
|---|---|---|
| Claude Code | 2.1.304 | claude --version, claude --help, official permissions documentation |
| Codex CLI | 0.163.0 | codex --version, codex --help, codex exec --help. The security documentation could not be read; see the end of this page. |
| Gemini CLI | 0.64.0 | gemini --version, gemini --help, official policy-engine documentation |
The checks were done on October 21, 2026. Each version was the latest published on npm that day (we updated Gemini CLI from 0.4.1 first). Flags and defaults change between releases, so treat this page as a map and confirm with --help on your own version. Wording in quotation marks is the tool's own; everything else is our paraphrase.
1. Three questions for any agent
- What can it do without asking me? Reading files, editing files, running shell commands, using the network.
- Where can it act? Which directories, and whether commands run inside a sandbox.
- How do I turn the safety off, and when is that acceptable? Every tool has a way; each one's own help says it is for isolated environments.
2. Running without a person at the keyboard
| You want | Claude Code | Codex CLI | Gemini CLI |
|---|---|---|---|
| Non-interactive run | claude -p (--print) | codex exec (alias e) | gemini -p (--prompt) |
| Machine-readable output | --output-format json or stream-json | --json (events as JSON lines) | --output-format json or stream-json |
| Fix the shape of the final answer | --json-schema | --output-schema FILE | no such option in --help |
| Do not save the session | --no-session-persistence (with -p) | --ephemeral | no such option in --help |
| Spending cap | --max-budget-usd (with -p) | no such option in --help | no such option in --help |
Two details matter for safety. Claude Code's help says that in non-interactive mode the workspace trust dialog is skipped, so it should only be used in directories you trust, and that settings files that fail validation are silently ignored in that mode. Gemini CLI has --skip-trust, which trusts the current workspace for the session.
3. Approval: what happens before an action runs
| Tool | Setting | Values |
|---|---|---|
| Claude Code | --permission-mode | manual (also called default): asks on first use of each tool. acceptEdits: accepts file edits and common filesystem commands such as mkdir and mv in the working directories. plan: reads and runs read-only commands, does not edit source files. auto: runs without routine prompts while a background classifier checks actions against your request. dontAsk: automatically denies anything that would otherwise prompt. bypassPermissions: skips prompts except for a short list of actions that no mode auto-approves. |
| Codex CLI | --ask-for-approval (-a) | The help lists on-request (the model decides when to ask) and never (never ask; execution failures are returned to the model). --approve-for-me routes approval requests through automatic review using the workspace-write sandbox. |
| Gemini CLI | --approval-mode | default: prompts for approval. auto_edit: auto-approves edit tools. plan: read-only. yolo: auto-approves all tools. |
One naming trap: Gemini CLI's documentation page for its policy engine writes autoEdit, while the command-line flag in --help accepts auto_edit. Use the spelling your version's help prints.
4. Where the agent can act
| Tool | Setting | What it does |
|---|---|---|
| Claude Code | --add-dir, --restricted | --add-dir extends tool access to more directories. --restricted removes the built-in tools that run commands or code and the web-fetch tool unless --tools names them, ignores user, project, and local settings files (managed settings and --settings still apply), confines file tools to the working directories, and refuses bypassPermissions. The documentation also describes a setting, permissions.blockReadsOutsideWorkingDirectories, that makes the file tools refuse paths outside the working directories. |
| Codex CLI | --sandbox (-s), --add-dir, --search | --sandbox selects the policy for model-generated shell commands: read-only, workspace-write, or danger-full-access. --add-dir adds directories that are writable alongside the workspace. --search enables live web search, with no per-call approval according to the help. codex sandbox runs a command inside the Codex-provided sandbox. |
| Gemini CLI | --sandbox (-s), --include-directories | --sandbox is a boolean ("Run in sandbox?"). --include-directories adds directories to the workspace. |
5. Switching safety off
| Tool | How | What the tool itself says |
|---|---|---|
| Claude Code | --dangerously-skip-permissions, --permission-mode bypassPermissions; --allow-dangerously-skip-permissions makes bypass available without enabling it | The help recommends it only for sandboxes with no internet access. The documentation says bypass mode also skips prompts for writes to protected paths such as .git and .claude, and to use it only in isolated environments such as containers or virtual machines. Setting permissions.disableBypassPermissionsMode to "disable" prevents it. |
| Codex CLI | --dangerously-bypass-approvals-and-sandbox; --dangerously-bypass-hook-trust | The first is described as skipping all confirmation prompts and running commands without sandboxing, "EXTREMELY DANGEROUS", intended solely for environments that are externally sandboxed. The second runs enabled hooks without persisted hook trust and is "DANGEROUS". |
| Gemini CLI | --yolo (-y), --approval-mode yolo; --raw-output | The first two auto-approve all actions. --raw-output disables sanitization of model output, for example allowing ANSI escape sequences, and the help warns it can be a security risk if the model output is untrusted. --accept-raw-output-risk suppresses that warning. |
The --raw-output warning is the same lesson as our note on treating model output as untrusted input: what the model returns can be shaped by text it read, so what consumes it must not assume it is clean.
6. Rules and policies
| Tool | Mechanism | Notes from the documentation and help |
|---|---|---|
| Claude Code | Allow, ask, and deny rules in settings; --allowedTools, --disallowedTools | Rules are evaluated in the order deny, ask, allow, and the first match decides, so a broad deny rule cannot be carved out by a narrower allow rule. Rules live in ~/.claude/settings.json (user), .claude/settings.json (project), and .claude/settings.local.json (local), and managed settings rank highest: no other level, including command-line arguments, overrides a managed permission rule. The documentation states that permission rules are enforced by the tool, not by the model, and that a Bash deny or ask rule covers the form of the command the model usually writes and is not a security boundary around the program. |
| Codex CLI | Configuration and execution-policy rules | The help describes a user configuration file at ~/.codex/config.toml (under $CODEX_HOME), -c key=value overrides, --strict-config to reject unrecognized fields, and user or project execution-policy .rules files that codex exec --ignore-rules skips. We could not read the documentation that explains how these rules are written. |
| Gemini CLI | Policy engine (TOML files) | Each rule sets conditions, a decision of allow, deny, or ask_user, and a priority from 0 to 999; the highest-priority match wins. In non-interactive mode, ask_user is treated as deny. User policies are read from ~/.gemini/policies/*.toml; admin policies come from a system directory (on macOS, /Library/Application Support/GeminiCli/policies) or from --admin-policy, and admin rules override user rules. Workspace policies are described as currently disabled. --policy loads extra policy files, and --allowed-tools is marked deprecated in favor of the policy engine. |
7. What happens when nobody can answer a prompt
Unattended runs need a decision for actions that would normally prompt. The three tools differ, and the difference is easy to miss:
- Claude Code: with
-p,--permission-prompts nonedenies anything that would prompt; the default,host, leaves the answer to the SDK host or a permission-prompt tool. - Gemini CLI: a policy rule with
ask_useris treated asdenyin non-interactive mode. - Codex CLI:
--ask-for-approval nevernever asks, and the help says execution failures are returned to the model instead of prompting you.
8. How we would start (our opinion, not tested)
- Begin with the narrowest mode that does the job:
planin Claude Code and Gemini CLI,--sandbox read-onlyin Codex CLI. Widen only when you need to. - Treat every flag in section 5 as unsuitable outside an isolated environment. That is what the tools' own descriptions say.
- For unattended runs, choose the "nobody answers" behavior deliberately (section 7) and keep the working directory to what the task needs.
- Use rules and sandboxes together. The tools' rules decide what they will try; a sandbox or container limits what an action can do if a rule is wrong.
What we did not verify
- We did not run an agent session for this page. Behavior is described from help output and documentation, not observed.
- Codex CLI: we could not read its security documentation (the address we tried redirected to a page about a different product). Everything about Codex here comes from
--help. We did not verify what each sandbox mode permits, such as network access, whether approval values beyond the two listed exist in the configuration file, or how execution-policy rules are written. - Gemini CLI: the policy-engine page contains inconsistencies we noticed (it uses
autoEditwhere the flag isauto_edit, and its tier numbers differ between its table and its examples). We did not test the policy engine. - We checked on macOS with the installed command-line tools. We did not check Linux, Windows, IDE extensions, or desktop apps, and we did not cover slash commands, hooks, or MCP server settings.
How to reproduce the check
On your machine, with your versions:
claude --version && claude --help
codex --version && codex --help && codex exec --help
gemini --version && gemini --helpIf the output differs from this page, trust your output and tell us so we can update the page.