Documentation v0.3.2
Earshot / Core concepts

Permissions and trust modes

Deny-first evaluation, real diffs, and explicit trust boundaries.

Reviewed for 0.3.2 · Latest documentation

Permissions#

Modes plan | ask | accept-edits | auto | yolo, over Tool(pattern) rules loaded from global, project and local settings. decide() is pure — rules and a request in, a decision out — so the policy is tested without a terminal.

Order is the policy, and it is deliberately not "most specific wins":

  1. A matching deny rule refuses. No mode and no allow rule overrides it.
  2. Read-only tools never prompt.
  3. plan refuses every mutating tool.
  4. A write outside cwd prompts whatever the rules say, in every mode but yolo.
  5. yolo allows.
  6. A matching ask rule prompts even where an allow rule would match.
  7. A matching allow rule allows.
  8. Otherwise the mode decides.

Rules from the three scopes are concatenated rather than shadowing one another: a scoped override would let a project's checked-in settings remove a deny rule the user set globally.

Command patterns match every segment of a chained command. Without that, Bash(npm run *) would allow npm run build && rm -rf ~.

Choose a mode#

ModeDefault behavior
planRefuse mutating tools; inspect and plan only
askPrompt for mutating actions without an allow rule
accept-editsAllow file edits in the working directory; commands and network still prompt
autoAllow actions unless rules or an outside-directory write require otherwise
yoloAllow without prompts; explicit deny rules still win
earshot --permission-mode ask

Review the real action#

A terminal permission prompt shows the actual command or complete diff. Choose Allow once, persist an exact tool/target rule for the project, or Deny and tell the agent why. Escape denies. A saved rule does not become a wildcard.

Files do not approve themselves#

Skills may narrow tools. Hooks may deny or downgrade an allow to a prompt. MCP read-only hints are displayed but never trusted as authority. Project MCP processes and in-process extensions stay inert until explicitly trusted. See MCP, hooks, and extensions.

Something unclear?Suggest a correction on GitHub ↗