# Permissions and approvals

> Choose a run mode, answer approval requests and questions, and set the defaults for new conversations.

The run mode decides what an agent may do without asking you. When it needs your go-ahead or an answer, it shows a card right above the message field.

## Choose a run mode

Open the **+** menu of the message field and pick a mode in the **Run mode** section.

| Mode | What the agent can do |
| --- | --- |
| **Plan** | Suggests a plan without changing files. |
| **Default permissions** | Asks before edits, commands, or access outside the safe boundary. |
| **Approve for me** | A reviewer allows safe actions and asks you only for potentially unsafe ones. Available with Claude and Codex. |
| **Full access** | Skips permission prompts and sandbox restrictions. |

If you change the mode while a turn is running, the change applies to your next message.

When you switch a conversation to **Full access** while your default is still **Default permissions**, Vato asks **Make Full access the default?** Choose **Yes, make it default**, **Not now**, or **Don't ask again**. Your answer never changes the current conversation.

> [!WARNING]
> In **Full access**, the agent can change any file and run any command without asking. Use it only on projects you are ready to let the agent change freely.

## Work with a plan

In **Plan** mode, the agent ends with a proposed plan. A **Plan ready** banner appears above the message field:

- **Start implementation** switches the conversation to your default run mode and starts the work.
- **Discuss** puts the cursor back in the message field so you can refine the plan.
- **Reject** dismisses the plan.

## Answer an approval request

When the agent needs permission, an **Authorization required** card shows what it wants to do, such as a shell command, a file write, a file read or a tool, with the exact command or path. If several requests are waiting, the card shows a counter like **1/3**.

| Button | Effect |
| --- | --- |
| **Approve once** | Allows this action only. |
| **Always allow this turn** | Allows it for the rest of this turn. |
| **Deny** | Refuses this action. |
| **Cancel turn** | Stops the whole turn. |

Sometimes the agent stops because an action isn't allowed in the current mode. A **Permission required** card then offers **Allow in** followed by a mode, which switches the conversation to that mode and resumes the work, or **Deny**.

## Answer the agent's questions

An **Agent question** card lists the options the agent suggests.

1. Pick an option, or choose **Other** to write your own answer.
2. When there are several questions, use **Next** and **Back**, then **Send**.
3. Choose **Skip** to let the agent continue without your answer.

The card shows when the question expires. After that, it reads **Question expired**.

## Set your defaults

Go to `Settings → General`:

- **Default agent execution mode**: the mode new conversations start in.
- **Agent collaboration**: how readily agents stop to ask you a question. Choose **Autonomous**, **Collaborative** or **Guided**.
- **Question answer window**: how long you have to answer: **Never**, **5 min**, **15 min**, **30 min**, **1 h** or **4 h**.

> [!TIP]
> In `Settings → Notifications`, turn on **Desktop: permission required** or **Phone: permission required** to hear about approval requests while you are away from the conversation.

## Next steps

- [Undo an agent's changes](checkpoints-and-rewind.md)
- [Answer requests from your phone](../mobile/companion-app.md)

Source: https://vatoide.com/docs/agents/permissions-and-approvals