The checkpoint

About this video

An agent that can rename three hundred photos can also delete them. So before a command runs, it stops to ask: allow this command? Listing a folder, running the tests, checking the status: forty times a day. After forty yeses, you'd probably click yes to deleting the archive too. The danger isn't the asking; it's asking so often that you stop reading.

Who is asking? The model only writes the request. Every tool call passes through the harness on its way to your computer, and there a permission check decides: allow it, ask you first, or refuse it. The model can ask for anything; only what's permitted happens. When an action is refused, the model is told so as a tool result, and usually tries another way or asks you what to do. Nothing touched your computer.

Two things set that check. A permission mode says how cautious the agent is overall. In Claude Code you switch with Shift+Tab: default asks before edits, commands and the network; accept edits lets file changes through; plan looks and changes nothing; auto lets a separate checker review each action; bypass permissions allows everything, and belongs only in a throwaway sandbox. Rules are precise: lists of actions that are always allowed, asked about or refused, kept in a settings file such as .claude/settings.json. Anything on neither list falls back to the mode. Deny is checked first, then ask, then allow, and the first list that matches decides, so if one rule allows every git command and another denies git push, the push is refused.

A sandbox limits what an action can reach once it runs: which folders a command can see, and whether it can use the network. Allow the routine, deny what must never happen, and read every question you still get. This video explains agent permissions on Knaph.

Transcript

1. 0:00Your agent stops to ask: allow this command? Forty times a day.
2. 0:06Listing a folder. Running the tests. Checking the status.
3. 0:11Then one that would delete the archive.
4. 0:14After forty yeses, you'd probably click yes to that too.
5. 0:18So who is asking? The model only writes the request.
6. 0:22Every tool call passes through the harness on its way to your computer.
7. 0:28There, a permission check decides: allow it, ask you first, or refuse.
8. 0:33The model can ask for anything. Only what's permitted happens.
9. 0:40Say it tries to push the code.
10. 0:44The check refuses. Nothing touched your computer.
11. 0:48The refusal goes back to the model, as a tool result.
12. 0:52So it tries another way, or asks you what to do.
13. 0:57That checkpoint is set in two ways.
14. 1:02First, a mode: how cautious the agent is overall.
15. 1:06Default asks before edits, commands and the network.
16. 1:10Accept edits lets file changes through. Commands still ask.
17. 1:14Plan looks, and changes nothing.
18. 1:18Auto lets a separate checker review each action.
19. 1:22And bypass allows everything. Only in a sandbox.
20. 1:26Second, rules. A list of what's always allowed, asked, or refused.
21. 1:31Allow the tests and the status check: they go ahead with no question.
22. 1:36Deny reading the secrets file, and pushing the code.
23. 1:40Anything on neither list falls back to the mode. Usually: ask.
24. 1:46In Claude Code, these live in a settings file.
25. 1:52Here's the catch. One rule allows every git command.
26. 1:56Another denies git push.
27. 1:59Deny is checked first, then ask, then allow.
28. 2:03The first list that matches decides. So the push is refused.
29. 2:08You can't allow by accident what you meant to forbid.
30. 2:14Rules decide which actions run. A sandbox limits what they can reach.
31. 2:19Which folders a command can see, and whether it can use the network.
32. 2:24Even if a command slips through, it can't touch what's outside.
33. 2:28That's the only place for bypass permissions: a throwaway sandbox.
34. 2:34So allow the routine things, and deny what must never happen.
35. 2:39The questions you still get are rare.
36. 2:42And worth reading. Read every one.
37. 2:50The model asks for anything. The harness decides.