Permission Modes: plan vs acceptEdits

Two Modes, Different Trust Levels

• plan (read-only)
  • › The agent can read files, search code, and analyze — but cannot modify anything
  • › Perfect for code review (read and report), research (explore codebase), and analysis (understand architecture)
• acceptEdits (autonomous)
  • › The agent can read AND write files, run commands, make changes
  • › Needed for implementation (writing code), bug fixes (editing broken code), and automation (running builds and tests)
• Risk with acceptEdits — an agent with acceptEdits running in your working directory can modify files you're actively editing. If something goes wrong, you're dealing with merge conflicts against AI changes.

Safety Patterns in Practice

1. 1 Safety pattern — combine acceptEdits with isolation: 'worktree'. The agent works on a copy of the repo, not your active files. If it messes up, just delete the worktree.
2. 2 Our practice — only one agent has acceptEdits (the step executor). All others are read-only. Default to plan unless the agent's job is to write code.
3. 3 Check your agent definitions — any agent with acceptEdits that doesn't need it? Switch it to plan
4. 4 Choose permission mode by agent role
   • › Reviewers, analyzers, searchers → plan
   • › Implementers, fixers, automators → acceptEdits + worktree