---
title: Permissions
description: What Lampson does on its own, what it asks you about, and what it refuses no matter what — plus the three modes: ask, yolo and strict.
---
# Permissions

Lampson sorts every action into three kinds:

| kind | examples | `ask` (default) | `yolo` | `strict` |
|---|---|---|---|---|
| **always refused** | `rm -rf /`, formatting disks, fork bombs, force-pushing to main | blocked | blocked | blocked |
| **risky** | recursive deletes, `git reset --hard`, `sudo`, `curl … \| sh`, `DROP TABLE`, writing `.env`, installing packages | **asks you** | allowed | blocked |
| **everyday** | reading, editing files in the project, running tests, `git status` | allowed | allowed | allowed |

Change the mode any time: `/ask` `/yolo` `/strict` in the terminal, the selector in the web header, or start with `lampson --yolo` / `lampson --strict`. `.env` only sets the default.

## Some things always ask

Regardless of mode, a few actions always wait for a human because they bring outside code or instructions onto your machine: installing a [skill](/en/docs/skills), turning a [plugin](/en/docs/plugins) on, adding an [MCP server](/en/docs/mcp). `yolo` does not skip them; `strict` denies them.

## Where it can reach

File tools only work inside the project folder you opened. Absolute paths, `..`, and sibling folders are refused — not by a rule the agent could argue with, but by the language Lampson is written in: each tool declares the folder it may touch, and the runtime enforces it.

The `bash` tool runs real commands, and those are not confined by the language. That is why risky commands ask, and why for a public deployment you should run Lampson [in a container](/en/docs/deploy).

## Sub-agents never ask

A [sub-agent](/en/docs/subagents) works in the background and cannot interrupt you. It runs `strict` (risky → denied, and it reports the limitation) unless you started Lampson with `--yolo`.

## Unattended runs

A [scheduled task](/en/docs/schedules) has its permission envelope fixed when you create it. In `ask` mode, a risky action waits for your approval — in the web UI, or through a link on your phone. No answer in time means denied. Nothing is ever auto-approved.