All pages
Guides
What happens when developers run agents with permission prompts off?
What bypass mode, Run Everything and --yolo actually allow, how to find out who runs that way, how to lock it, and how to put a person back in front of risky calls.
Permission prompts are tiring, so people turn them off. The agent then runs every tool it chooses, with no one reading the command first. That is a reasonable trade in a disposable container. On a laptop with your credentials, it means anything the agent is talked into happens at once.
What each switch does#
| Agent | Prompts off | What it allows |
|---|---|---|
| Claude Code | --dangerously-skip-permissions, or permissions.defaultMode: "bypassPermissions" | Shell commands, edits, web fetches and MCP calls run without a prompt, apart from a few actions Claude Code always asks about |
| Cursor | Run Everything, or --yolo / --force in the CLI | Commands and tool calls run without asking |
| Codex | --yolo / --dangerously-bypass-approvals-and-sandbox | No approvals, and Codex's own sandbox is off too |
| Gemini CLI | --yolo | Every action is approved automatically |
| Copilot CLI | --allow-all-tools, --allow-all or --yolo | Tools run without asking |
A repository can switch prompts off as well: its own settings file can turn them off for everyone who opens it.
Claude Code's documentation recommends skipping permissions only in an isolated environment, such as a container or VM, and Codex names its flag --dangerously-bypass-approvals-and-sandbox.
What still works with prompts off#
- Hooks. Claude Code still runs its
PreToolUsehooks, so a hook can still refuse a call, or ask. - Codex's sandbox, which is a separate setting from its approvals, unless
--dangerously-bypass-approvals-and-sandboxturns both off. - Whatever isolates the machine, such as a container or VM.
Preventing it#
Most agents let an administrator forbid these modes in managed settings:
| Agent | Lock it with |
|---|---|
| Claude Code | permissions.disableBypassPermissionsMode: "disable" in managed settings |
| Cursor | approvalMode: "allowlist" |
| Codex | allowed_sandbox_modes and allowed_approval_policies in requirements.toml |
| Gemini CLI | security.disableYoloMode: true |
Push them through your device management. See How do I roll out coding-agent security with Jamf, Intune or Kandji?
What locking does not tell you#
Whether the lock reached every machine, who ran a session with a flag before it did, which repositories carry their own bypass settings, and what happened in those sessions. A launch flag leaves nothing in a settings file to audit.
Where Golem fits#
Who runs that way. The Golem agent reads each agent's settings files every 10 minutes, reads the command lines of running agents (because a launch flag leaves nothing in a file), and its hooks report each session's permission mode on every call. Security Inventory → Agent settings lists each risky setting with the machines that have it, the file and value, and the managed setting that would lock it. A session run with prompts off stays listed for 7 days. A new risky setting is a signed entry in the record and an alert, which resolves itself when the machine is fixed. Only the setting's name and value leave the machine. See The posture report.
A person back in front of risky calls. Golem's built-in rule Shell command with permission prompts off matches:
entry.permission_mode == 'bypassPermissions' && entry.tool_name == 'Bash'It ships at Watch. Set it to Ask and, in Claude Code, every shell command in a bypass-mode session shows Claude Code's own approval prompt with Golem's reason; Claude Code shows a hook's prompt in every permission mode. In Codex, and in Cursor's Run Everything mode, the client cannot ask, so Ask becomes a refusal. Set it to Block to refuse them everywhere. Cursor's Run Everything reads as bypassPermissions.
The shell jail does not care about the mode. On macOS, every shell command a Claude Code session runs is jailed whatever its permission mode, so a bypass-mode session still cannot read private keys or write to shell profiles. See The shell jail.
What Golem does not do#
- It never changes an agent's settings. It reports them; your MDM or the client's admin console fixes them.
- It cannot stop an agent from starting in a risky mode. It acts on the session's calls while it runs.
- Some changes leave no trace: Gemini CLI's YOLO switched on inside a session, and Devin's mode changed inside a session, are not seen. A short session of a client Golem did not connect can fall between two 10-minute scans.