Permissions & Approval

Overview

Loop gives you fine-grained control over what the agent is allowed to do. Configure per-tool approval policies, file edit review behavior, and project-level trust gates.

Tool Permissions

Each built-in tool has a configurable permission policy:

Policy	Behavior
`allow`	Tool runs automatically without prompting
`ask`	You’re prompted to approve each invocation
`deny`	Tool is blocked from executing

Default Permissions

{
  "toolPermissions": {
    "read": "allow",
    "write": "ask",
    "edit": "ask",
    "bash": "ask"
  }
}

By default, read runs freely while write, edit, and bash require your approval.

Setting Permissions

In ~/.loop/agent/settings.json:

{
  "toolPermissions": {
    "read": "allow",
    "write": "allow",
    "edit": "ask",
    "bash": "ask"
  }
}

Session-Scoped Approval

When prompted to approve a tool call, you can choose to accept all for the remainder of the session. This lets you start with safety checks and then streamline once you trust the agent’s approach.

File Edit Review

Control how file edits are reviewed:

Mode	Behavior
`newSession` (default)	Prompt for review on the first edit of each session
`always`	Always prompt for review
`never`	Never prompt for review

Slash Command

/review always
/review never
/review newSession

Settings

{
  "fileEditReview": "newSession"
}

External Diff Review

Loop can open file diffs in an external editor for review:

{
  "diffEditor": "cursor"
}

Supported editors:

Value	Editor
`cursor`	Cursor IDE (`--diff` mode)
`code`	VS Code (`--diff` mode)

When enabled, file edits open a side-by-side diff in your editor, and you approve or reject from there.

Project Trust

Loop supports project-level configuration via .loop/settings.json in your project root. For security, these overrides are only loaded when the project is trusted.

Trust Gate

When Loop encounters a .loop/settings.json in an untrusted project, it prompts you:

This project has local settings. Trust this project? [yes/no]

Managing Trust

/trust yes    # Trust the current project
/trust no     # Untrust the current project

Trust state is stored in ~/.loop/agent/trust.json.

Default Trust Policy

{
  "defaultProjectTrust": "ask"
}

Value	Behavior
`ask` (default)	Prompt when loading project settings
`always`	Auto-trust all projects
`never`	Never load project settings

Project-Level Overrides

When a project is trusted, .loop/settings.json overlays the global settings:

{
  "defaultModel": "gpt-4o",
  "sandbox": {
    "mode": "local",
    "isolation": "full"
  },
  "toolPermissions": {
    "bash": "allow"
  }
}

This lets teams share consistent agent settings per-project.

Only trust projects from sources you control. Malicious project settings could configure permissive tool policies.

Getting Started

Guides

Features

Permissions & Approval

Overview

Tool Permissions

Default Permissions

Setting Permissions

Session-Scoped Approval

File Edit Review

Slash Command

Settings

External Diff Review

Project Trust

Trust Gate

Managing Trust

Default Trust Policy

Project-Level Overrides

​Overview

​Tool Permissions

​Default Permissions

​Setting Permissions

​Session-Scoped Approval

​File Edit Review

​Slash Command

​Settings

​External Diff Review

​Project Trust

​Trust Gate

​Managing Trust

​Default Trust Policy

​Project-Level Overrides

Overview

Tool Permissions

Default Permissions

Setting Permissions

Session-Scoped Approval

File Edit Review

Slash Command

Settings

External Diff Review

Project Trust

Trust Gate

Managing Trust

Default Trust Policy

Project-Level Overrides