---
schema_version: "1"
id: 8cc76d91ba88454312f96cd1e3a1622dc13bd4e80892ecce84a995899394a704
title: Permissions and Safety
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/salesforcedx/agentforcevibes/guides/files/afv-permissions-safety.md
canonical_url: https://developer.salesforce.com/docs/platform/agentforcevibes/guide/afv-permissions-safety.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 0c926ea0768185eed225135c4bc7eded9be777003022c01de4635bc87ed8e4bc
products:
  - Agentforce Vibes Developer Guide
  - salesforcedx
---
# Permissions and Safety

Control what Agentforce Vibes can do without requiring your approval. Configure permissions to balance productivity with security by defining which operations run automatically and which require review.

Access Permissions and Safety settings by opening the Agentforce Vibes panel, clicking the **Settings** icon (⚙), and expanding **Permissions & Safety**.

## Set the Default Session Mode

The default session mode controls how much autonomy the agent has when executing tasks. Choose from three modes:

| Mode                   | Behavior                                                                                                                   |
| ---------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| **Ask every time**     | Pauses for your approval before every tool call—reads, file edits, commands, and MCP tools all ask first.                  |
| **Run safe defaults**  | Auto-approves read-only actions and allowed shell commands. Still asks before file edits, other commands, and write tools. |
| **Bypass (trust all)** | Runs every tool automatically with no confirmation, including file edits and shell commands. Use with caution.             |

**Run safe defaults** is the recommended starting point. It reduces interruptions for safe read operations while keeping approval gates for actions that modify files or call external systems.

## Configure Safety Guardrails

Safety guardrails apply only in **Run safe defaults** mode. They define which shell commands the agent can run without prompting.

The default command safety guardrails includes these categories:

- Filesystem reads
- Shell basics
- Git reads
- Node / npm / pnpm
- Salesforce CLI

To add a command to the list, type it in the **Add command...** field and click **+ Add**. Use specific command patterns to restrict the list to known-safe operations.

To view and manage individual tool permissions, click **Manage tool permissions** at the top of the Permissions & Safety section.

## Auto-Approve Salesforce MCP Write Tools

The **Auto-approve Salesforce MCP write tools** toggle is off by default. When enabled, Agentforce Vibes automatically approves non-destructive Model Context Protocol (MCP) write operations. Destructive actions—such as deploy and delete—still require approval unless you change the setting for a specific tool.

Enable this option only after you're comfortable with how the agent uses MCP write tools in your workflow.

## Considerations

- Safety guardrails have no effect in **Ask every time** or **Bypass (trust all)** modes. In Ask every time, every action prompts regardless of the guardrails. In Bypass, every action runs regardless of the guardrails.
- The command guardrails controls shell execution only. File edit and MCP tool approvals are governed separately by the session mode.
- Scope guardrail entries to commands you've verified as safe for your project. Adding broad patterns (for example, `git *`) to the guardrails increases agent autonomy.
- Permission modes don't replace code review. The agent can produce code that compiles but contains logic errors. Use permission modes to manage filesystem access; use code review to verify correctness.

## See Also

- [Trust and Verification](https://developer.salesforce.com/docs/platform/agentforcevibes/guide/afv-trust.md)
- [Debug Logging](https://developer.salesforce.com/docs/platform/agentforcevibes/guide/afv-debug-logging.md)
- [MCP Servers](https://developer.salesforce.com/docs/platform/agentforcevibes/guide/afv-mcp-servers.md)