Docs menu
⌘K

Core Concepts

Permissions

A permission rule is one of three answers: ask, allow, or deny. Midas checks the rule before a tool runs. An explicit deny fails at once, an ask opens a prompt, and an allow runs without interrupting you.

Try the three answers

{
  "permission": {
    "edit": "allow",
    "bash": { "git push": "ask", "*": "allow" },
    "read": { "*.env": "ask", "*": "allow" },
    "webfetch": "deny"
  }
}

The last matching rule wins. A pattern is matched against the tool input, so a broad * can allow most of a tool while a narrower rule keeps one path behind a prompt.

The keys

  • readReading files.
  • editCreating, editing, and deleting files.
  • bashRunning shell commands.
  • external_directoryReading or writing outside the project.
  • webfetch, websearchFetching a page and searching the web.
  • taskStarting a subagent.
  • skillLoading a skill.
  • browserOpening a page and interacting with it through the browser tool.
  • questionAsking you a question during a run.

Defaults

  • Most work inside the project is allowed, including edits and shell commands.
  • Reading a .env file asks first. An .env.example is allowed.
  • Leaving the project directory asks first.
  • A repeated failing loop asks before it continues.
  • The browser tool asks before clicking, typing, or evaluating a page.
  • Secrets are treated as a separate read path and ask first.

Auto and manual mode

midas --auto
midas --manual

--auto approves every action that is not explicitly denied. A deny still stops the tool. --manual prompts for every action. Headless runs can use --auto as well.

Auto mode removes the prompts, so treat it as a safety decision. Use it for a disposable checkout, a sandbox, or a task you have scoped tightly. Do not use it on a machine or repository where an unwanted command would be expensive.

Remembered answers

When a prompt appears, choosing allow always writes that rule into your global config. The same action does not ask again in later sessions. Edit the permission block to remove a rule you no longer want.

Per-agent rules

An agent can carry its own permission block in frontmatter. A read-only reviewer, for example, can deny edit while the build agent keeps it allowed. Agent rules are merged after the defaults.

With the local sandbox

When the local OS sandbox is active and available, contained actions do not prompt. On macOS and Linux, headless runs enable it by default. Interactive runs do not. Windows has no local sandbox backend yet, so it uses the normal permission rules.

Related