Vol. IX · The Agent-Computer Interface · IX.1
Allow, Ask, Deny
Every side-effecting tool sits behind a permission. Allow what is cheap and reversible. Ask what is consequential. Deny what is out of scope. The model proposes; the gate decides.
7 min read
Doctrine
- Classify tools: read (allow), write-workspace (ask or allow in a sandbox), prod-side-effect (ask), irreversible (deny or high-friction ask).
- Permission is code, logged, and resumable. A prompt that says 'be careful' is not a permission.
- Session modes (plan vs act, read-only vs write) change the default, not the existence of the gate.
The three-way gate
Cline, Codex, Goose, and Claude Code all converge on allow / ask / deny. Plan mode is a session whose default is deny-for-write. Act mode widens the allowlist. OpenHands isolates the computer so 'allow' still cannot touch the host. The interesting design is the ask: it must pause the run, show the exact command and diff, and resume from the same checkpoint.
Factor 7 (humans as tools) is the ask path. Factor 8 (own control flow) is the deny path. Do not collapse them into a system prompt.
Anti-patterns
- A shell tool with no allowlist of binaries or paths.
- Remembering 'the user said yes once' as a blanket grant for the rest of the repo.
- Asking the model to decide whether something is dangerous.